NexaPay API Documentation

// Node.js / Express. Configure the same secret in your NexaPay dashboard.
const crypto = require('crypto');
const express = require('express');
const app = express();
const webhookSecret = process.env.NEXAPAY_WEBHOOK_SECRET;
if (!webhookSecret) throw new Error('NEXAPAY_WEBHOOK_SECRET is required');

// Register this route BEFORE app.use(express.json()). Verify the exact bytes.
app.post('/webhooks/nexapay', express.raw({ type: 'application/json' }), async (req, res) => {
  const signature = req.get('x-nexapay-signature');
  const timestamp = req.get('x-nexapay-timestamp');
  if (!Buffer.isBuffer(req.body) || !/^sha256=[a-f0-9]{64}$/i.test(signature || '') ||
      !/^\d+$/.test(timestamp || '')) {
    return res.status(401).json({ error: 'Missing or invalid signature' });
  }

  const sentAt = Number(timestamp); // NexaPay timestamps are milliseconds.
  if (!Number.isSafeInteger(sentAt) || Math.abs(Date.now() - sentAt) > 5 * 60 * 1000) {
    return res.status(401).json({ error: 'Webhook expired' });
  }
  const expected = crypto.createHmac('sha256', webhookSecret)
    .update(timestamp + '.').update(req.body).digest();
  const received = Buffer.from(signature.slice(7), 'hex');
  if (received.length !== expected.length || !crypto.timingSafeEqual(received, expected)) {
    return res.status(401).json({ error: 'Invalid signature' });
  }

  let payment;
  try { payment = JSON.parse(req.body.toString('utf8')); }
  catch { return res.status(400).json({ error: 'Invalid JSON' }); }
  if (!payment || typeof payment.order_id !== 'string' || typeof payment.status !== 'string') {
    return res.status(400).json({ error: 'Invalid payment event' });
  }

  try {
    // Implement these on your server. Atomically deduplicate by order + status.
    // Check the expected amount and currency before fulfilling your own order.
    if (payment.status === 'completed') {
      await fulfillOrderOnce(payment.order_id, payment);
    } else if (payment.status === 'expired') {
      await cancelOrderOnce(payment.order_id);
    }
    res.json({ received: true });
  } catch {
    // A non-2xx response allows NexaPay to retry delivery.
    res.status(500).json({ error: 'Event processing failed' });
  }
});