Pre-integration Preparation

TIMESTAMP=$(date +%s)
NONCE=$(uuidgen)
BODY='{"amount":1999,"currency":"USD"}'
SIGN_PAYLOAD="${TIMESTAMP}.${NONCE}.${BODY}"
SIGNATURE=$(echo -n "${SIGN_PAYLOAD}" | openssl dgst -sha256 -hmac "${SECRET_KEY}" | awk '{print $2}')

curl -X POST https://api.stablepay.co/api/v1/checkout/sessions/create \
  -H "Authorization: Bearer ${API_KEY}" \
  -H "X-StablePay-Timestamp: ${TIMESTAMP}" \
  -H "X-StablePay-Nonce: ${NONCE}" \
  -H "X-StablePay-Signature: ${SIGNATURE}" \
  -H "Content-Type: application/json" \
  -d "${BODY}"

import hmac, hashlib, json, time, uuid, requests

API_KEY = "sk_live_xxx"
SECRET_KEY = "your_secret_key"

body = {"amount": 1999, "currency": "USD"}
body_str = json.dumps(body, separators=(",", ":"))  # Compact JSON
timestamp = str(int(time.time()))
nonce = str(uuid.uuid4())

sign_payload = f"{timestamp}.{nonce}.{body_str}"
signature = hmac.new(
    SECRET_KEY.encode(),
    sign_payload.encode(),
    hashlib.sha256,
).hexdigest()

resp = requests.post(
    "https://api.stablepay.co/api/v1/checkout/sessions/create",
    headers={
        "Authorization": f"Bearer {API_KEY}",
        "X-StablePay-Timestamp": timestamp,
        "X-StablePay-Nonce": nonce,
        "X-StablePay-Signature": signature,
        "Content-Type": "application/json",
    },
    data=body_str,
)
print(resp.status_code, resp.json())

import crypto from "crypto";
import { randomUUID } from "crypto";

const API_KEY = "sk_live_xxx";
const SECRET_KEY = "your_secret_key";

const body = { amount: 1999, currency: "USD" };
const bodyStr = JSON.stringify(body);
const timestamp = Math.floor(Date.now() / 1000).toString();
const nonce = randomUUID();

const signPayload = `${timestamp}.${nonce}.${bodyStr}`;
const signature = crypto
  .createHmac("sha256", SECRET_KEY)
  .update(signPayload)
  .digest("hex");

const resp = await fetch(
  "https://api.stablepay.co/api/v1/checkout/sessions/create",
  {
    method: "POST",
    headers: {
      Authorization: `Bearer ${API_KEY}`,
      "X-StablePay-Timestamp": timestamp,
      "X-StablePay-Nonce": nonce,
      "X-StablePay-Signature": signature,
      "Content-Type": "application/json",
    },
    body: bodyStr,
  },
);
console.log(resp.status, await resp.json());

import hashlib
import hmac
import time
from typing import Mapping


def verify_webhook(
    headers: Mapping[str, str],
    raw_body: bytes,
    secret_key: str,
    tolerance_seconds: int = 300,
) -> bool:
    """
    Verify StablePay webhook signature.

    Signature payload format:
        "{timestamp}.{nonce}.{raw_body}"

    Notes:
    - raw_body must be the original HTTP request body bytes.
    - do not parse JSON and serialize it again before verification.
    """

    if not secret_key:
        return False

    timestamp = headers.get("X-StablePay-Timestamp")
    nonce = headers.get("X-StablePay-Nonce")
    signature = headers.get("X-StablePay-Signature")

    if not timestamp or not nonce or not signature:
        return False

    try:
        ts = int(timestamp)
    except ValueError:
        return False

    if abs(int(time.time()) - ts) > tolerance_seconds:
        return False

    if not (16 <= len(nonce) <= 64):
        return False

    signed_payload = (
        timestamp.encode("utf-8")
        + b"."
        + nonce.encode("utf-8")
        + b"."
        + raw_body
    )

    expected_signature = hmac.new(
        secret_key.encode("utf-8"),
        signed_payload,
        hashlib.sha256,
    ).hexdigest()

    return hmac.compare_digest(expected_signature, signature)

private String computeSignature(String timestamp, String nonce, byte[] rawBody, String secret) {
    if (secret == null || secret.isEmpty()) {
        throw new IllegalArgumentException("secret is empty");
    }

    String payload = timestamp + "." + nonce + "." + new String(rawBody, StandardCharsets.UTF_8);

    try {
        Mac mac = Mac.getInstance("HmacSHA256");
        mac.init(new SecretKeySpec(secret.getBytes(StandardCharsets.UTF_8), "HmacSHA256"));
        byte[] hashBytes = mac.doFinal(payload.getBytes(StandardCharsets.UTF_8));
        return bytesToHex(hashBytes, hashBytes.length).toLowerCase();
    } catch (Exception e) {
        throw new RuntimeException("compute HMAC failed", e);
    }
}