Webhooks

POST /votre/adresse HTTP/1.1
Content-Type: application/json
User-Agent: StampyWallet-Webhooks/1.0
StampyWallet-Evenement: passage.cree
StampyWallet-Id: evt_WdGHduXPRbExh0vh5eYtCjXo
StampyWallet-Signature: t=1792648365,v1=8f3c…(64 caractères hexadécimaux)

{
  "id": "evt_WdGHduXPRbExh0vh5eYtCjXo",
  "type": "passage.cree",
  "cree_le": "2026-10-22T05:52:45.694Z",
  "commerce": { "id": "9f1cbdfc-df71-4fab-a554-3bdbb7c71ebf", "nom": "Le Café des Crochets" },
  "donnees": {
    "client": { "id": "40de4b86-1d7a-4cc6-add3-b7a83fa43c04", "prenom": "Inès",
                "telephone": "+33611223344", "email": "ines@example.com" },
    "passage": {
      "id": "226fdea1-ba59-49fb-93e6-60a14a765134",
      "quantite": 1,
      "montant": null,
      "devise": "EUR",
      "reference": "caisse-1",
      "source": "scan",
      "piste": "normal",
      "tampons": 1,
      "objectif": 2
    }
  }
}

StampyWallet-Signature: t=<horodatage unix en secondes>,v1=<signature>
signature = hex( HMAC-SHA256( clé = secret, message = "<t>.<corps brut>" ) )

const crypto = require('node:crypto');

/** corpsBrut : le corps reçu, en Buffer (ou en texte), AVANT tout JSON.parse. */
function verifierStampyWallet(secret, corpsBrut, entete, tolerance = 300) {
  let t = null;
  const v1 = [];
  for (const morceau of String(entete || '').split(',')) {
    const i = morceau.indexOf('=');
    const cle = morceau.slice(0, i).trim();
    const valeur = morceau.slice(i + 1).trim();
    if (cle === 't' && /^\d+$/.test(valeur)) t = Number(valeur);
    if (cle === 'v1') v1.push(valeur);
  }
  if (t === null || v1.length === 0) return false;
  if (Math.abs(Math.floor(Date.now() / 1000) - t) > tolerance) return false;
  const attendue = crypto.createHmac('sha256', secret)
    .update(`${t}.`).update(corpsBrut).digest('hex');
  return v1.some((s) => s.length === attendue.length
    && crypto.timingSafeEqual(Buffer.from(s), Buffer.from(attendue)));
}

// Avec Express : garder le corps brut sur cette route.
app.post('/stampywallet', express.raw({ type: 'application/json' }), (req, res) => {
  const ok = verifierStampyWallet(process.env.STAMPYWALLET_WEBHOOK_SECRET,
    req.body, req.get('StampyWallet-Signature'));
  if (!ok) return res.status(400).end();
  const evenement = JSON.parse(req.body.toString('utf8'));
  // dédoublonner sur evenement.id, puis traiter plus tard
  res.status(200).end();
});

import hashlib
import hmac
import time


def verifier_stampywallet(secret: str, corps_brut: bytes, entete: str, tolerance: float = 300) -> bool:
    """corps_brut : les octets reçus (Flask : request.get_data()), avant tout json.loads."""
    t, v1 = None, []
    for morceau in (entete or "").split(","):
        cle, _, valeur = morceau.strip().partition("=")
        if cle == "t" and valeur.isdigit():
            t = int(valeur)
        elif cle == "v1":
            v1.append(valeur)
    if t is None or not v1:
        return False
    if abs(int(time.time()) - t) > tolerance:
        return False
    attendue = hmac.new(secret.encode(), f"{t}.".encode() + corps_brut, hashlib.sha256).hexdigest()
    return any(hmac.compare_digest(s, attendue) for s in v1)


# Avec Flask :
# @app.post("/stampywallet")
# def recevoir():
#     if not verifier_stampywallet(os.environ["STAMPYWALLET_WEBHOOK_SECRET"],
#                                  request.get_data(),
#                                  request.headers.get("StampyWallet-Signature", "")):
#         abort(400)
#     evenement = request.get_json()
#     return "", 200

<?php
function verifier_stampywallet(string $secret, string $corpsBrut, string $entete, int $tolerance = 300): bool
{
    $t = null;
    $v1 = [];
    foreach (explode(',', $entete) as $morceau) {
        $paire = explode('=', trim($morceau), 2);
        if (count($paire) !== 2) {
            continue;
        }
        if ($paire[0] === 't' && ctype_digit($paire[1])) {
            $t = (int) $paire[1];
        } elseif ($paire[0] === 'v1') {
            $v1[] = $paire[1];
        }
    }
    if ($t === null || count($v1) === 0) {
        return false;
    }
    if (abs(time() - $t) > $tolerance) {
        return false;
    }
    $attendue = hash_hmac('sha256', $t . '.' . $corpsBrut, $secret);
    foreach ($v1 as $s) {
        if (hash_equals($attendue, $s)) {
            return true;
        }
    }
    return false;
}

// le corps brut, avant json_decode
$corps = file_get_contents('php://input');
$ok = verifier_stampywallet(getenv('STAMPYWALLET_WEBHOOK_SECRET'), $corps,
    $_SERVER['HTTP_STAMPYWALLET_SIGNATURE'] ?? '');

secret : whsec_5WZbPq8rLk2N7xYdTf3Hc9JmVg4RsQe1
t      : 1761134400
corps  : {"id":"evt_4fK9mQ2xT7bL1nR8vZ3cW6yH","type":"passage.cree","cree_le":"2026-10-22T12:00:00.000Z","commerce":{"id":"9b2f6c1e-4d3a-4f7b-8e21-5a6c7d8e9f01","nom":"Le Café du Coin"},"donnees":{"client":{"id":"3c1d2e4f-5a6b-4c7d-8e9f-0a1b2c3d4e5f","prenom":"Camille"},"passage":{"id":"7e8f9a0b-1c2d-4e3f-9a4b-5c6d7e8f9a0b","quantite":1,"montant":null,"devise":"EUR","reference":null,"source":"scan","piste":"normal","tampons":4,"objectif":10}}}
v1     : 4346dff69a3e9e25937b22ec031a8eaf8cfce3baca4dfb932865682b8f891f1d
en-tête: t=1761134400,v1=4346dff69a3e9e25937b22ec031a8eaf8cfce3baca4dfb932865682b8f891f1d