Webhooks

import DodoPayments from 'dodopayments';
import express from 'express';

const app = express();
app.use(express.raw({ type: 'application/json' }));

const client = new DodoPayments({
  bearerToken: process.env.DODO_PAYMENTS_API_KEY,
  webhookKey: process.env.DODO_PAYMENTS_WEBHOOK_KEY,
});

app.post('/webhook', async (req, res) => {
  try {
    const event = client.webhooks.unwrap(req.body.toString(), {
      headers: {
        'webhook-id': req.headers['webhook-id'] as string,
        'webhook-signature': req.headers['webhook-signature'] as string,
        'webhook-timestamp': req.headers['webhook-timestamp'] as string,
      },
    });
    res.json({ received: true });
  } catch (error) {
    res.status(401).json({ error: 'Invalid signature' });
  }
});

from fastapi import FastAPI, Request, HTTPException
from dodopayments import DodoPayments
import os

app = FastAPI()
client = DodoPayments(
    bearer_token=os.getenv("DODO_PAYMENTS_API_KEY"),
    webhook_key=os.getenv("DODO_PAYMENTS_WEBHOOK_KEY"),
)

@app.post("/webhook")
async def handle_webhook(request: Request):
    try:
        event = client.webhooks.unwrap(
            await request.body(),
            headers={
                "webhook-id": request.headers.get("webhook-id", ""),
                "webhook-signature": request.headers.get("webhook-signature", ""),
                "webhook-timestamp": request.headers.get("webhook-timestamp", ""),
            },
        )
        return {"received": True}
    except Exception:
        raise HTTPException(status_code=401, detail="Invalid signature")

import (
	"io"
	"net/http"
	"os"
	"github.com/dodopayments/dodopayments-go"
	"github.com/dodopayments/dodopayments-go/option"
)

func webhookHandler(w http.ResponseWriter, r *http.Request) {
	client := dodopayments.NewClient(
		option.WithBearerToken(os.Getenv("DODO_PAYMENTS_API_KEY")),
		option.WithWebhookKey(os.Getenv("DODO_PAYMENTS_WEBHOOK_KEY")),
	)
	rawBody, _ := io.ReadAll(r.Body)
	event, err := client.Webhooks.Unwrap(rawBody, r.Header)
	if err != nil {
		http.Error(w, "Invalid signature", http.StatusUnauthorized)
		return
	}
	_ = event // Handle the verified event here.
	w.WriteHeader(http.StatusOK)
}

import { Webhook } from "standardwebhooks";
import express from "express";

const app = express();

const webhook = new Webhook(process.env.DODO_PAYMENTS_WEBHOOK_KEY);

// Use express.raw() for the webhook route so the exact bytes Dodo Payments
// signed are preserved. Parsing with express.json() first and then calling
// JSON.stringify(req.body) can alter the payload (e.g. whitespace), which
// breaks signature verification.
app.post(
  '/webhook/dodo-payments',
  express.raw({ type: "application/json" }),
  async (req, res) => {
    try {
      // Extract webhook headers
      const webhookHeaders = {
        "webhook-id": req.headers["webhook-id"] as string,
        "webhook-signature": req.headers["webhook-signature"] as string,
        "webhook-timestamp": req.headers["webhook-timestamp"] as string,
      };

      // Verify the webhook signature against the raw, unmodified body
      const payload = req.body.toString("utf8");
      await webhook.verify(payload, webhookHeaders);

      // Parse the payload only after verification succeeds
      const data = JSON.parse(payload);

      // Acknowledge receipt immediately
      res.status(200).json({ received: true });

      // Process webhook asynchronously
      processWebhookAsync(data).catch(console.error);

    } catch (error) {
      console.error('Webhook verification failed:', error);
      res.status(401).json({ error: 'Invalid signature' });
    }
  }
);

// Register express.json() for other routes after the webhook route so it
// doesn't consume the raw body needed for signature verification above.
app.use(express.json());

async function processWebhookAsync(data: any) {
  // Handle the webhook event based on type
  switch (data.type) {
    case 'payment.succeeded':
      await handlePaymentSucceeded(data);
      break;
    case 'subscription.active':
      await handleSubscriptionActive(data);
      break;
    // Add more event handlers...
  }
}

const { Webhook } = require("standardwebhooks");
const axios = require("axios");
const crypto = require("crypto");

// Generate test webhook
const timestamp = new Date();
const webhookId = crypto.randomUUID();
const payload = {
  business_id: "bus_H4ekzPSlcg",
  type: "payment.succeeded",
  timestamp: timestamp.toISOString(),
  data: {
    payload_type: "Payment",
    payment_id: "pay_test456",
    amount: 2999
  }
};

// Sign the payload
const webhookSecret = process.env.DODO_PAYMENTS_WEBHOOK_KEY;
const webhookInstance = new Webhook(webhookSecret);
const payloadString = JSON.stringify(payload);
const signature = webhookInstance.sign(webhookId, timestamp, payloadString);

// Send test webhook. CommonJS scripts don't support top-level await, so use .then().
axios.post('http://localhost:3000/webhook/dodo-payments', payload, {
  headers: {
    "webhook-id": webhookId,
    "webhook-timestamp": Math.floor(timestamp.getTime() / 1000),
    "webhook-signature": signature,
    "Content-Type": "application/json"
  }
}).then((response) => {
  console.log("Test webhook sent successfully:", response.data);
});