Webhooks

{
  "order_id": "fd04c5780062121628e05324003eef30",
  "status": "FULFILLED",
  "status_date": "2023-06-05 19:53:08",
  "created_at": "2023-06-02 14:44:00",
  "updated_at": "2023-06-09 13:53:08",
  "internal_reason": "Order has been completed.",
  "external_reason": "Your payment was successfully received. Your order is now being processed.",
  "order_type": "ONRAMP",
  "crypto_coin": "ETH",
  "crypto_blockchain": "ETH",
  "crypto_amount": "0.228632",
  "fiat_currency": "USD",
  "fiat_amount": "100",
  "asset_price": "0.018656",
  "payment": "100",
  "processing_fee": "1.95",
  "network_fee": "2.33",
  "usd_exchange_rate": "1.36",
  "transaction_hash": "0x9401a7173d7bd2ad73e8b798fdc30c83fb0529e6edbad163c549a5ad136407be"
}

{
  "identity_reference": "partner-customer-123",
  "status": "ACCOUNT_BLOCKED",
  "status_date": "2023-06-05 19:53:08",
  "internal_reason": "Customer account is blocked.",
  "external_reason": "Your order could not be processed."
}

{
  "identityReference": "customer-12345",
  "account": {
    "exists": true,
    "blocked": false,
    "createdAt": "2023-06-05T19:53:08.320Z"
  },
  "kyc": {
    "status": "VERIFIED"
  }
}

Authorization: Bearer {API_KEY}:{SIGNATURE}:{NONCE}

POST\nYOUR_WEBHOOK_PATH\nNONCE\nPAYLOAD

import hmac

MY_WEBHOOK_PATH = '/webhooks/banxa'
KEY = '[YOUR_API_KEY]'
SECRET = '[YOUR_API_SECRET]'

def verify_webhook(auth_header, request_body):
    _, token = auth_header.split('Bearer ', 1)
    received_key, received_signature, nonce = token.split(':')

    data = f"POST\n{MY_WEBHOOK_PATH}\n{nonce}\n{request_body}"
    expected = hmac.new(SECRET.encode('utf-8'), data.encode('utf-8'), 'sha256').hexdigest()

    return hmac.compare_digest(received_signature, expected)

const crypto = require('crypto');

const MY_WEBHOOK_PATH = '/webhooks/banxa';
const KEY = '[YOUR_API_KEY]';
const SECRET = '[YOUR_API_SECRET]';

function verifyWebhook(authHeader, requestBody) {
    const token = authHeader.replace('Bearer ', '');
    const [receivedKey, receivedSignature, nonce] = token.split(':');

    const data = `POST\n${MY_WEBHOOK_PATH}\n${nonce}\n${requestBody}`;
    const expected = crypto.createHmac('sha256', SECRET).update(data).digest('hex');

    return crypto.timingSafeEqual(Buffer.from(receivedSignature), Buffer.from(expected));
}

<?php
$MY_WEBHOOK_PATH = '/webhooks/banxa';
$KEY = '[YOUR_API_KEY]';
$SECRET = '[YOUR_API_SECRET]';

function verifyWebhook($authHeader, $requestBody, $myWebhookPath, $key, $secret) {
    $token = str_replace('Bearer ', '', $authHeader);
    [$receivedKey, $receivedSignature, $nonce] = explode(':', $token);

    $data = implode("\n", ['POST', $myWebhookPath, $nonce, $requestBody]);
    $expected = hash_hmac('sha256', $data, $secret);

    return hash_equals($expected, $receivedSignature);
}

import javax.crypto.Mac;
import javax.crypto.spec.SecretKeySpec;
import java.security.MessageDigest;
import java.util.Formatter;

private static final String MY_WEBHOOK_PATH = "/webhooks/banxa";
private static final String SECRET = "[YOUR_API_SECRET]";

public boolean verifyWebhook(String authHeader, String requestBody) throws Exception {
    String token = authHeader.replace("Bearer ", "");
    String[] parts = token.split(":");
    String nonce = parts[2];
    String receivedSignature = parts[1];

    String data = "POST\n" + MY_WEBHOOK_PATH + "\n" + nonce + "\n" + requestBody;
    SecretKeySpec signingKey = new SecretKeySpec(SECRET.getBytes(), "HmacSHA256");
    Mac mac = Mac.getInstance("HmacSHA256");
    mac.init(signingKey);
    Formatter formatter = new Formatter();
    for (byte b : mac.doFinal(data.getBytes())) formatter.format("%02x", b);
    String expected = formatter.toString();

    return MessageDigest.isEqual(receivedSignature.getBytes(), expected.getBytes());
}

import CryptoKit

let MY_WEBHOOK_PATH = "/webhooks/banxa"
let SECRET = "[YOUR_API_SECRET]"

func verifyWebhook(authHeader: String, requestBody: String) -> Bool {
    let token = authHeader.replacingOccurrences(of: "Bearer ", with: "")
    let parts = token.split(separator: ":")
    guard parts.count == 3 else { return false }
    let nonce = String(parts[2])
    let receivedSignature = String(parts[1])

    let data = "POST\n\(MY_WEBHOOK_PATH)\n\(nonce)\n\(requestBody)"
    let secretKey = SymmetricKey(data: SECRET.data(using: .utf8)!)
    let expected = HMAC<SHA256>.authenticationCode(for: data.data(using: .utf8)!, using: secretKey)
        .map { String(format: "%02hhx", $0) }.joined()

    return receivedSignature == expected
}

require 'openssl'

MY_WEBHOOK_PATH = '/webhooks/banxa'
SECRET = '[YOUR_API_SECRET]'

def verify_webhook(auth_header, request_body)
    token = auth_header.sub('Bearer ', '')
    received_key, received_signature, nonce = token.split(':')

    data = "POST\n#{MY_WEBHOOK_PATH}\n#{nonce}\n#{request_body}"
    expected = OpenSSL::HMAC.hexdigest('sha256', SECRET, data)

    ActiveSupport::SecurityUtils.secure_compare(received_signature, expected)
end