Webhooks

curl -X PUT https://api.mivaapay.com/api/v1/webhooks/endpoint \
  -H "Authorization: Bearer $MIVAAPAY_SECRET_KEY" \
  -H "Content-Type: application/json" \
  -d '{ "url": "https://boutique.example.com/webhooks/mivaapay" }'

$endpoint = Http::withToken(env('MIVAAPAY_SECRET_KEY'))
    ->put('https://api.mivaapay.com/api/v1/webhooks/endpoint', [
        'url' => 'https://boutique.example.com/webhooks/mivaapay',
    ])
    ->json('data');

// $endpoint['secret'] : à stocker, il sert à vérifier les signatures

const res = await fetch('https://api.mivaapay.com/api/v1/webhooks/endpoint', {
  method: 'PUT',
  headers: {
    Authorization: `Bearer ${process.env.MIVAAPAY_SECRET_KEY}`,
    'Content-Type': 'application/json'
  },
  body: JSON.stringify({ url: 'https://boutique.example.com/webhooks/mivaapay' })
});

const { data } = await res.json();

endpoint = requests.put(
    'https://api.mivaapay.com/api/v1/webhooks/endpoint',
    json={'url': 'https://boutique.example.com/webhooks/mivaapay'},
    headers={'Authorization': f"Bearer {SECRET_KEY}"},
    timeout=30,
).json()['data']

{
  "success": true,
  "data": {
    "url": "https://boutique.example.com/webhooks/mivaapay",
    "secret": "whsec_XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX"
  }
}

{
  "id": "5c8b8a1e-1f0e-4c0a-9a3e-6f8c2b1d4e77",
  "event": "payment.succeeded",
  "livemode": true,
  "created_at": "2026-08-05T10:25:02+00:00",
  "data": {
    "reference": "9f2c1a44-8b0e-4b2e-9b0a-2f1d6e5c7a31",
    "identifier": "Id2841",
    "external_id": "cmd_1042",
    "status": "succeeded",
    "amount": 5000,
    "fee_amount": 90,
    "total_amount": 5090,
    "currency": "XOF",
    "description": "Commande #1042",
    "payment_mode": {
      "id": 1,
      "name": "MTN Bénin",
      "type": "mobile_money",
      "operator": "mtn",
      "country": "Bénin",
      "country_code": "BJ"
    },
    "customer": {
      "firstname": "Awa",
      "lastname": "Diallo",
      "email": "awa@example.com",
      "phone_number": "22997000000"
    },
    "metadata": { "panier": "1042" },
    "created_at": "2026-08-05T10:24:11+00:00",
    "updated_at": "2026-08-05T10:25:02+00:00"
  }
}

// Laravel — routes/web.php
Route::post('/webhooks/mivaapay', function (Request $request) {
    $raw    = $request->getContent();          // corps brut, avant tout parsing
    $header = $request->header('X-MivaaPay-Signature', '');

    parse_str(str_replace(',', '&', $header), $parts);
    $timestamp = $parts['t'] ?? '';
    $received  = $parts['v1'] ?? '';

    if (abs(time() - (int) $timestamp) > 300) {
        return response('horodatage trop ancien', 400);
    }

    $expected = hash_hmac('sha256', $timestamp . '.' . $raw, config('services.mivaapay.webhook_secret'));

    if (!hash_equals($expected, $received)) {
        return response('signature invalide', 400);
    }

    $event = json_decode($raw, true);

    // … traitement idempotent, puis :
    return response()->noContent();
})->withoutMiddleware([VerifyCsrfToken::class]);

// Express — le corps brut est indispensable
const crypto = require('crypto');

app.post('/webhooks/mivaapay',
  express.raw({ type: 'application/json' }),
  (req, res) => {
    const header = req.get('X-MivaaPay-Signature') || '';
    const parts = Object.fromEntries(header.split(',').map(p => p.split('=')));

    const age = Math.abs(Date.now() / 1000 - Number(parts.t));
    if (!parts.t || age > 300) return res.status(400).send('horodatage trop ancien');

    const expected = crypto
      .createHmac('sha256', process.env.MIVAAPAY_WEBHOOK_SECRET)
      .update(`${parts.t}.${req.body}`)
      .digest('hex');

    const ok = parts.v1
      && parts.v1.length === expected.length
      && crypto.timingSafeEqual(Buffer.from(parts.v1), Buffer.from(expected));

    if (!ok) return res.status(400).send('signature invalide');

    const event = JSON.parse(req.body.toString());

    // … traitement idempotent, puis :
    res.status(204).end();
  });

# Flask
import hashlib, hmac, os, time
from flask import request, abort

SECRET = os.environ['MIVAAPAY_WEBHOOK_SECRET']

@app.post('/webhooks/mivaapay')
def mivaapay_webhook():
    raw = request.get_data()                    # corps brut, avant tout parsing
    header = request.headers.get('X-MivaaPay-Signature', '')
    parts = dict(p.split('=', 1) for p in header.split(',') if '=' in p)

    timestamp, received = parts.get('t', ''), parts.get('v1', '')

    if not timestamp or abs(time.time() - int(timestamp)) > 300:
        abort(400, 'horodatage trop ancien')

    expected = hmac.new(
        SECRET.encode(),
        f'{timestamp}.'.encode() + raw,
        hashlib.sha256,
    ).hexdigest()

    if not hmac.compare_digest(expected, received):
        abort(400, 'signature invalide')

    event = request.get_json()

    # … traitement idempotent, puis :
    return '', 204

if (WebhookRecu::where('delivery_id', $event['id'])->exists()) {
    return response()->noContent();     // déjà traité
}

WebhookRecu::create(['delivery_id' => $event['id'], 'event' => $event['event']]);

// … traitement métier

curl -X POST https://api.mivaapay.com/api/v1/webhooks/test \
  -H "Authorization: Bearer $MIVAAPAY_SECRET_KEY"

{
  "success": true,
  "data": {
    "sent": true,
    "delivery_id": "1f0c9d3a-4f11-9c22-7d5a-1e0b3c68b71e",
    "url": "https://boutique.example.com/webhooks/mivaapay"
  }
}

{
  "success": true,
  "data": [
    {
      "id": "5c8b8a1e-1f0e-4c0a-9a3e-6f8c2b1d4e77",
      "event": "payment.succeeded",
      "url": "https://boutique.example.com/webhooks/mivaapay",
      "status": "success",
      "attempts": 2,
      "response_code": 204,
      "created_at": "2026-08-05T10:25:02+00:00",
      "delivered_at": "2026-08-05T10:25:14+00:00"
    }
  ],
  "meta": { "current_page": 1, "per_page": 25, "total": 41, "last_page": 2 }
}