Panduan Webhooks

{
  "id": "8c1a2b3d-4e5f-6789-abcd-ef0123456789",
  "type": "order.paid",
  "created_at": "2026-09-08T10:00:00.000Z",
  "data": {
    "order": {
      "id": "11111111-1111-4111-8111-111111111111",
      "status": "paid",
      "payment_reference": "INV-123",
      "amount": 99000,
      "subtotal": 99000,
      "currency": "IDR",
      "settlement_channel": "platform_gateway",
      "payment_provider": "duitku",
      "payment_method": "qris",
      "buyer": {
        "name": "Budi",
        "email": "budi@example.com",
        "phone": "081234567890"
      },
      "items": [
        {
          "type": "product",
          "title": "Ebook Starter",
          "quantity": 1,
          "unit_price": 99000,
          "line_total": 99000,
          "product_id": "22222222-2222-4222-8222-222222222222",
          "bundle_id": null
        }
      ],
      "expires_at": null,
      "created_at": "2026-09-08T09:55:00.000Z",
      "updated_at": "2026-09-08T10:00:00.000Z",
      "payment_url": null,
      "requires_payment": false
    }
  }
}

import { createHmac, timingSafeEqual } from "crypto";

function verifyWebhook(secret, header, rawBody, toleranceSec = 300) {
  const parts = Object.fromEntries(
    header.split(",").map((p) => {
      const i = p.indexOf("=");
      return [p.slice(0, i).trim(), p.slice(i + 1).trim()];
    })
  );
  const t = Number(parts.t);
  const v1 = parts.v1;
  if (!t || !v1) return false;
  if (Math.abs(Math.floor(Date.now() / 1000) - t) > toleranceSec) return false;
  const expected = createHmac("sha256", secret)
    .update(`${t}.${rawBody}`)
    .digest("hex");
  const a = Buffer.from(v1, "utf8");
  const b = Buffer.from(expected, "utf8");
  return a.length === b.length && timingSafeEqual(a, b);
}

$rawBody = file_get_contents("php://input");
$header = $_SERVER["HTTP_X_KAWAN_SIGNATURE"] ?? "";
$parts = [];
foreach (explode(",", $header) as $piece) {
  [$k, $v] = array_map("trim", explode("=", $piece, 2) + [1 => ""]);
  $parts[$k] = $v;
}
$t = (int) ($parts["t"] ?? 0);
$v1 = $parts["v1"] ?? "";
if (!$t || $v1 === "") { http_response_code(401); exit; }
if (abs(time() - $t) > 300) { http_response_code(401); exit; }
$expected = hash_hmac("sha256", $t . "." . $rawBody, $secret);
if (!hash_equals($expected, $v1)) { http_response_code(401); exit; }
$event = json_decode($rawBody, true);