Webhooks

Webhook-Id: evt_12345
Webhook-Timestamp: 1788000000
Webhook-Signature: v1,BASE64_SIGNATURE
X-Datashop-Event: TRANSACTION_SUCCESSFUL
X-Datashop-Reference: merchant-ref-8905fff6767

{
  "event": "TRANSACTION_SUCCESSFUL",
  "message": "Purchase processed successfully.",
  "data": {
    "reference": "merchant-ref-8905fff6767",
    "customer_id": "45705225097",
    "service": "electricity",
    "product_name": "jos-electric-prepaid",
    "quantity": "1000",
    "provider": "Jos Electric",
    "paid_amount": 990,
    "balance_before": 12500,
    "balance_after": 11510,
    "transaction_status": "successful",
    "remark": "7060-8360-1787-0933-6869\n\n(4.5 KWH)",
    "token": "7060-8360-1787-0933-6869",
    "units": "4.5",
    "meter_number": "45705225097",
    "customer_name": "UMAR MOHD AWWAL",
    "customer_address": "NEW MILE 3",
    "disco": "Jos Electric - JED",
    "transaction_date": "2026-08-02T09:57:35.000000Z"
  }
}

Webhook-Id.Webhook-Timestamp.raw_body

import crypto from "node:crypto";

const secret = "whsec_...";
const webhookId = request.headers["webhook-id"];
const timestamp = request.headers["webhook-timestamp"];
const signatureHeader = request.headers["webhook-signature"];
const rawBody = request.rawBody;

const signedPayload = `${webhookId}.${timestamp}.${rawBody}`;
const expected = crypto
  .createHmac("sha256", secret)
  .update(signedPayload)
  .digest("base64");

const received = String(signatureHeader || "").replace("v1,", "");

if (
  !crypto.timingSafeEqual(
    Buffer.from(expected),
    Buffer.from(received)
  )
) {
  throw new Error("Invalid webhook signature");
}