Webhooks

import express from "express";
import { constructWebhookEvent, WebhookSignatureError } from "@clocknext/sdk";

const app = express();
const SECRET = process.env.CLOCKNEXT_WEBHOOK_SECRET!; // whsec_…

// express.raw keeps the body as bytes so the signature can be checked.
app.post("/webhooks/clocknext", express.raw({ type: "application/json" }), (req, res) => {
  let event;
  try {
    // Checks the signature and rejects events older than 5 minutes.
    event = constructWebhookEvent(req.body, req.header("x-clocknext-signature"), SECRET);
  } catch (err) {
    if (err instanceof WebhookSignatureError) return res.status(400).send("Invalid signature");
    throw err;
  }

  switch (event.event_type) {
    case "wallet.balance.update":
      // e.g. sync your copy of event.data.current_balance
      break;
    case "wallet.balance.drop":
      // e.g. email the customer to top up
      break;
  }
  res.sendStatus(200);
});

app.listen(3000);

// Spring Boot (spring-boot-starter-web)
package com.example;

import java.nio.charset.StandardCharsets;
import java.security.MessageDigest;
import java.util.HexFormat;
import javax.crypto.Mac;
import javax.crypto.spec.SecretKeySpec;
import org.springframework.http.ResponseEntity;
import org.springframework.web.bind.annotation.*;

@RestController
public class ClocknextWebhook {

    private static final String SECRET = System.getenv("CLOCKNEXT_WEBHOOK_SECRET"); // whsec_…
    private static final long TOLERANCE_SECONDS = 5 * 60;

    static boolean verify(String rawBody, String header) throws Exception {
        if (header == null) return false;
        String t = null, v1 = null;
        for (String part : header.split(",")) {
            String[] kv = part.split("=", 2);
            if (kv.length != 2) continue;
            if (kv[0].equals("t")) t = kv[1];
            if (kv[0].equals("v1")) v1 = kv[1];
        }
        if (t == null || v1 == null) return false;
        long timestamp;
        try {
            timestamp = Long.parseLong(t);
        } catch (NumberFormatException e) {
            return false;
        }
        if (Math.abs(System.currentTimeMillis() / 1000 - timestamp) > TOLERANCE_SECONDS) return false;

        Mac mac = Mac.getInstance("HmacSHA256");
        mac.init(new SecretKeySpec(SECRET.getBytes(StandardCharsets.UTF_8), "HmacSHA256"));
        byte[] digest = mac.doFinal((t + "." + rawBody).getBytes(StandardCharsets.UTF_8));
        String expected = HexFormat.of().formatHex(digest);
        return MessageDigest.isEqual(
            expected.getBytes(StandardCharsets.UTF_8), v1.getBytes(StandardCharsets.UTF_8));
    }

    // Take the body as a String so it is exactly what was signed.
    @PostMapping("/webhooks/clocknext")
    public ResponseEntity<String> receive(
            @RequestBody String rawBody,
            @RequestHeader(value = "X-Clocknext-Signature", required = false) String signature)
            throws Exception {
        if (!verify(rawBody, signature)) {
            return ResponseEntity.badRequest().body("Invalid signature");
        }
        // Parse rawBody with your JSON library, then switch on "event_type":
        //   wallet.balance.update -> e.g. sync your copy of data.current_balance
        //   wallet.balance.drop   -> e.g. email the customer to top up
        return ResponseEntity.ok().build();
    }
}

# Flask
import hashlib
import hmac
import json
import os
import time

from flask import Flask, request

app = Flask(__name__)
SECRET = os.environ["CLOCKNEXT_WEBHOOK_SECRET"]  # whsec_…
TOLERANCE_SECONDS = 5 * 60


def verify(raw_body: bytes, header: str | None) -> bool:
    if not header:
        return False
    parts = dict(p.split("=", 1) for p in header.split(",") if "=" in p)
    t, v1 = parts.get("t"), parts.get("v1")
    if not t or not v1 or not t.isdigit():
        return False
    if abs(time.time() - int(t)) > TOLERANCE_SECONDS:
        return False

    signed = f"{t}.".encode() + raw_body
    expected = hmac.new(SECRET.encode(), signed, hashlib.sha256).hexdigest()
    return hmac.compare_digest(expected, v1)


@app.post("/webhooks/clocknext")
def clocknext_webhook():
    # get_data() returns the body exactly as received, which the signature needs.
    raw_body = request.get_data()
    if not verify(raw_body, request.headers.get("X-Clocknext-Signature")):
        return "Invalid signature", 400

    event = json.loads(raw_body)
    if event["event_type"] == "wallet.balance.update":
        pass  # e.g. sync your copy of event["data"]["current_balance"]
    elif event["event_type"] == "wallet.balance.drop":
        pass  # e.g. email the customer to top up
    return "", 200

package main

import (
	"crypto/hmac"
	"crypto/sha256"
	"encoding/hex"
	"encoding/json"
	"io"
	"math"
	"net/http"
	"os"
	"strconv"
	"strings"
	"time"
)

var secret = os.Getenv("CLOCKNEXT_WEBHOOK_SECRET") // whsec_…

const toleranceSeconds = 5 * 60

func verify(rawBody []byte, header string) bool {
	if header == "" {
		return false
	}
	parts := map[string]string{}
	for _, p := range strings.Split(header, ",") {
		if k, v, ok := strings.Cut(p, "="); ok {
			parts[k] = v
		}
	}
	t, err := strconv.ParseInt(parts["t"], 10, 64)
	if err != nil || parts["v1"] == "" {
		return false
	}
	if math.Abs(float64(time.Now().Unix()-t)) > toleranceSeconds {
		return false
	}

	mac := hmac.New(sha256.New, []byte(secret))
	mac.Write([]byte(parts["t"] + "."))
	mac.Write(rawBody)
	expected := hex.EncodeToString(mac.Sum(nil))
	return hmac.Equal([]byte(expected), []byte(parts["v1"]))
}

func webhook(w http.ResponseWriter, r *http.Request) {
	// Read the body exactly as received: the signature covers these bytes.
	rawBody, err := io.ReadAll(r.Body)
	if err != nil || !verify(rawBody, r.Header.Get("X-Clocknext-Signature")) {
		http.Error(w, "Invalid signature", http.StatusBadRequest)
		return
	}

	var event struct {
		EventType string `json:"event_type"`
	}
	if err := json.Unmarshal(rawBody, &event); err != nil {
		http.Error(w, "Bad payload", http.StatusBadRequest)
		return
	}
	switch event.EventType {
	case "wallet.balance.update":
		// e.g. sync your copy of data.current_balance
	case "wallet.balance.drop":
		// e.g. email the customer to top up
	}
	w.WriteHeader(http.StatusOK)
}

func main() {
	http.HandleFunc("POST /webhooks/clocknext", webhook)
	http.ListenAndServe(":3000", nil)
}