Merchant API

curl https://api-beta.msavdogar.uz/v1/invoices/PAY_MYSHOP_7K2M9Q \
  -H "X-Api-Key: $MSAVDOGAR_API_KEY"

resp = requests.get(f"{API}/v1/invoices/PAY_MYSHOP_7K2M9Q", headers=HEADERS, timeout=15)
invoice = resp.json()
if invoice["status"] == "paid":
    mark_order_paid(invoice["order_id"])

import hashlib
import hmac
import os
import time

from fastapi import FastAPI, HTTPException, Request

app = FastAPI()
WEBHOOK_SECRET = os.environ["MSAVDOGAR_WEBHOOK_SECRET"].encode()


@app.post("/msavdogar/webhook")
async def msavdogar_webhook(request: Request):
    raw_body = await request.body()
    timestamp = request.headers.get("X-MSavdogar-Timestamp", "")
    signature = request.headers.get("X-MSavdogar-Signature", "")

    expected = hmac.new(WEBHOOK_SECRET, timestamp.encode() + b"." + raw_body, hashlib.sha256).hexdigest()
    if not hmac.compare_digest(expected, signature):
        raise HTTPException(status_code=400, detail="invalid signature")
    if not timestamp.isdigit() or abs(time.time() - int(timestamp)) > 300:
        raise HTTPException(status_code=400, detail="stale request")

    event = await request.json()
    if event["event"] == "payment.paid":
        data = event["data"]
        # Idempotent bo'ling: bir hodisa bir necha marta kelishi mumkin
        mark_order_paid(data["merchant_order_id"], data["invoice"])
    return {"ok": True}

const crypto = require("crypto");
const express = require("express");

const app = express();
const SECRET = process.env.MSAVDOGAR_WEBHOOK_SECRET;

app.post("/msavdogar/webhook", express.raw({ type: "application/json" }), (req, res) => {
  const timestamp = req.get("X-MSavdogar-Timestamp") || "";
  const signature = req.get("X-MSavdogar-Signature") || "";
  const expected = crypto
    .createHmac("sha256", SECRET)
    .update(Buffer.concat([Buffer.from(timestamp + "."), req.body]))
    .digest("hex");

  const valid = signature.length === expected.length &&
    crypto.timingSafeEqual(Buffer.from(signature), Buffer.from(expected));
  const fresh = Math.abs(Date.now() / 1000 - Number(timestamp)) <= 300;
  if (!valid || !fresh) return res.status(400).end();

  const event = JSON.parse(req.body.toString("utf8"));
  if (event.event === "payment.paid") {
    // buyurtmani to'langan deb belgilang (idempotent)
  }
  res.json({ ok: true });
});

<?php
$secret    = getenv('MSAVDOGAR_WEBHOOK_SECRET');
$body      = file_get_contents('php://input');
$timestamp = $_SERVER['HTTP_X_MSAVDOGAR_TIMESTAMP'] ?? '';
$signature = $_SERVER['HTTP_X_MSAVDOGAR_SIGNATURE'] ?? '';

$expected = hash_hmac('sha256', $timestamp . '.' . $body, $secret);
if (!hash_equals($expected, $signature) || abs(time() - (int) $timestamp) > 300) {
    http_response_code(400);
    exit;
}

$event = json_decode($body, true);
if ($event['event'] === 'payment.paid') {
    $invoice = $event['data']['invoice'];
    // buyurtmani to'langan deb belgilang (idempotent)
}

header('Content-Type: application/json');
echo json_encode(['ok' => true]);