{
  "event": "payment.paid",
  "invoiceId": "clx1abc123def456",
  "invoiceNumber": "INV-20250528-0001",
  "merchantReference": "ORDER-001",
  "amount": 150000,
  "feeAmount": 2250,
  "netAmount": 147750,
  "currency": "IDR",
  "status": "PAID",
  "customerName": "Budi Santoso",
  "customerEmail": "budi@email.com",
  "paidAt": "2025-05-28T12:30:00.000Z",
  "timestamp": 1717123456
}

X-ArtaPay-Signature: a1b2c3d4e5f6...  (HMAC-SHA256 hex)
X-ArtaPay-Event: payment.paid
X-ArtaPay-Timestamp: 1717123456

payload = timestamp + ":" + SHA256(requestBody)
signature = HMAC-SHA256(secretKey, payload)

const crypto = require('crypto');

function createSignature(secretKey, timestamp, body) {
  const bodyHash = crypto
    .createHash('sha256')
    .update(body)
    .digest('hex');
  
  const payload = `${timestamp}:${bodyHash}`;
  
  return crypto
    .createHmac('sha256', secretKey)
    .update(payload)
    .digest('hex');
}

// Penggunaan
const timestamp = Math.floor(Date.now() / 1000);
const body = JSON.stringify({ amount: 150000, customerName: 'Budi' });
const sig = createSignature('sk_test_xyz789', timestamp, body);

signature = HMAC-SHA256(webhookSecret, rawRequestBody)
Format: hex string

const crypto = require('crypto');

function verifyWebhookSignature(rawBody, signature, webhookSecret) {
  const expected = crypto
    .createHmac('sha256', webhookSecret)
    .update(rawBody) // raw body string, BUKAN parsed JSON
    .digest('hex');

  // Gunakan timingSafeEqual untuk mencegah timing attack
  try {
    return crypto.timingSafeEqual(
      Buffer.from(expected, 'hex'),
      Buffer.from(signature, 'hex')
    );
  } catch {
    return false;
  }
}

// Di Express handler:
app.post('/webhook/artapay', express.raw({ type: 'application/json' }), (req, res) => {
  const rawBody = req.body.toString();
  const signature = req.headers['x-artapay-signature'];

  if (!signature || !verifyWebhookSignature(rawBody, signature, process.env.ARTAPAY_WEBHOOK_SECRET)) {
    return res.status(401).json({ error: 'Invalid signature' });
  }

  const payload = JSON.parse(rawBody);
  // Proses event...
  res.status(200).json({ received: true });
});

<?php
$rawBody = file_get_contents('php://input');
$signature = $_SERVER['HTTP_X_ARTAPAY_SIGNATURE'] ?? '';
$webhookSecret = getenv('ARTAPAY_WEBHOOK_SECRET');

$expected = hash_hmac('sha256', $rawBody, $webhookSecret);

if (!hash_equals($expected, $signature)) {
    http_response_code(401);
    exit(json_encode(['error' => 'Invalid signature']));
}

$data = json_decode($rawBody, true);
// Proses event...
http_response_code(200);
echo json_encode(['received' => true]);

import hmac, hashlib, os
from flask import Flask, request, jsonify

app = Flask(__name__)

@app.route('/webhook/artapay', methods=['POST'])
def handle_webhook():
    raw_body = request.get_data()
    signature = request.headers.get('X-ArtaPay-Signature', '')
    secret = os.environ['ARTAPAY_WEBHOOK_SECRET']

    expected = hmac.new(secret.encode(), raw_body, hashlib.sha256).hexdigest()

    if not hmac.compare_digest(expected, signature):
        return jsonify({'error': 'Invalid signature'}), 401

    payload = request.get_json()
    # Proses event...
    return jsonify({'received': True}), 200

wss://artapay.michaelk.fun/api/v1/payments/{invoiceId}/ws

{
  "event": "INVOICE_STATUS",
  "invoiceId": "clx1abc123def456",
  "status": "PAID",
  "paidAt": "2025-05-28T12:30:00.000Z"
}

const invoiceId = "clx1abc123def456";
const ws = new WebSocket(`wss://artapay.michaelk.fun/api/v1/payments/${invoiceId}/ws`);

ws.onmessage = (event) => {
  const data = JSON.parse(event.data);
  if (data.event === "INVOICE_STATUS" && data.status === "PAID") {
    alert("Pembayaran berhasil!");
    ws.close();
  }
};

ws.onclose = (event) => {
  if (event.code === 1008) {
    console.warn("Fitur WebSocket belum aktif untuk merchant ini.");
  }
};

<script src="https://arta-pay.vercel.app/artapay.js"></script>

// Anda bisa mendaftarkan fungsi callback ketika pembayaran berhasil (Opsional)
ArtaPay.onSuccess = function(invoiceId) {
  console.log("Hore! Pembayaran berhasil untuk invoice:", invoiceId);
  window.location.href = "/order-success?id=" + invoiceId;
};

// Menampilkan popup pembayaran
// Anda bisa mempassing invoiceId langsung:
ArtaPay.checkout("clx1abc123def456");

// Atau mempassing paymentUrl:
// ArtaPay.checkout("https://arta-pay.vercel.app/pay/clx1abc123def456");