Menerima Webhook

// npm install express svix
import express from "express";
import { Webhook, WebhookVerificationError } from "svix";

const app = express();
const wh = new Webhook(process.env.SIMPLUS_WEBHOOK_SECRET); // whsec_...

// Pakai express.raw() khusus untuk route ini, jangan express.json()
app.post("/webhooks/simplus", express.raw({ type: "application/json" }), (req, res) => {
  const payload = req.body.toString("utf8"); // raw body
  try {
    wh.verify(payload, {
      "svix-id": req.header("svix-id"),
      "svix-timestamp": req.header("svix-timestamp"),
      "svix-signature": req.header("svix-signature"),
    });
  } catch (err) {
    if (err instanceof WebhookVerificationError) {
      return res.status(400).send("Invalid signature");
    }
    throw err;
  }

  // Parse JSON hanya setelah signature valid
  const event = JSON.parse(payload);

  // Balas dulu, baru proses
  res.sendStatus(204);

  if (event.type === "sales.persisted") {
    enqueue(req.header("svix-id"), event.data);
  }
});

function enqueue(messageId, sale) {
  // Di production, kirim ke queue (misalnya BullMQ, SQS, atau RabbitMQ)
  setImmediate(() => console.log("Transaksi diterima:", messageId, sale.id, sale.order_number, sale.paid_amount));
}

app.listen(3000, () => console.log("Listening on http://localhost:3000"));

<?php
// composer require svix/svix
//
// config/services.php:
//   'simplus' => ['webhook_secret' => env('SIMPLUS_WEBHOOK_SECRET')],
//
// routes/api.php (route API tidak memakai CSRF):
//   Route::post('/webhooks/simplus', \App\Http\Controllers\SimplusWebhookController::class);

namespace App\Http\Controllers;

use App\Jobs\ProcessSimplusSale;
use Illuminate\Http\Request;
use Svix\Exception\WebhookVerificationException;
use Svix\Webhook;

class SimplusWebhookController extends Controller
{
    public function __invoke(Request $request)
    {
        $payload = $request->getContent(); // raw body
        $headers = [
            'svix-id' => $request->header('svix-id'),
            'svix-timestamp' => $request->header('svix-timestamp'),
            'svix-signature' => $request->header('svix-signature'),
        ];

        try {
            $wh = new Webhook(config('services.simplus.webhook_secret'));
            $wh->verify($payload, $headers);
        } catch (WebhookVerificationException $e) {
            return response('Invalid signature', 400);
        }

        $event = json_decode($payload, true);

        if (($event['type'] ?? null) === 'sales.persisted') {
            // Proses berat di queue, bukan di request ini
            ProcessSimplusSale::dispatch($headers['svix-id'], $event['data']);
        }

        return response()->noContent(); // 204
    }
}

<?php
// composer require svix/svix
require __DIR__ . '/vendor/autoload.php';

use Svix\Exception\WebhookVerificationException;
use Svix\Webhook;

$payload = file_get_contents('php://input'); // raw body
$headers = [
    'svix-id' => $_SERVER['HTTP_SVIX_ID'] ?? '',
    'svix-timestamp' => $_SERVER['HTTP_SVIX_TIMESTAMP'] ?? '',
    'svix-signature' => $_SERVER['HTTP_SVIX_SIGNATURE'] ?? '',
];

try {
    $wh = new Webhook(getenv('SIMPLUS_WEBHOOK_SECRET'));
    $wh->verify($payload, $headers);
} catch (WebhookVerificationException $e) {
    http_response_code(400);
    exit('Invalid signature');
}

$event = json_decode($payload, true);

if (($event['type'] ?? null) === 'sales.persisted') {
    // Simpan ke tabel antrian, lalu proses dengan worker/cron terpisah
    // queue_push($headers['svix-id'], $event['data']);
}

http_response_code(204);

# pip install fastapi uvicorn svix
# Jalankan: uvicorn main:app --port 8000
import json
import os

from fastapi import BackgroundTasks, FastAPI, Request, Response
from svix.webhooks import Webhook, WebhookVerificationError

app = FastAPI()
wh = Webhook(os.environ["SIMPLUS_WEBHOOK_SECRET"])  # whsec_...


def process_sale(message_id: str, sale: dict) -> None:
    # Di production, kirim ke queue (misalnya Celery, RQ, atau SQS)
    print("Transaksi diterima:", message_id, sale["id"], sale["order_number"], sale["paid_amount"])


@app.post("/webhooks/simplus")
async def simplus_webhook(request: Request, background_tasks: BackgroundTasks):
    payload = await request.body()  # raw body (bytes)

    try:
        wh.verify(payload, request.headers)
    except WebhookVerificationError:
        return Response("Invalid signature", status_code=400)

    event = json.loads(payload)  # parse setelah signature valid

    if event["type"] == "sales.persisted":
        background_tasks.add_task(process_sale, request.headers["svix-id"], event["data"])

    return Response(status_code=204)

# pip install flask svix
import json
import os

from flask import Flask, request
from svix.webhooks import Webhook, WebhookVerificationError

app = Flask(__name__)
wh = Webhook(os.environ["SIMPLUS_WEBHOOK_SECRET"])  # whsec_...


@app.post("/webhooks/simplus")
def simplus_webhook():
    payload = request.get_data()  # raw body (bytes)
    headers = {
        "svix-id": request.headers.get("svix-id"),
        "svix-timestamp": request.headers.get("svix-timestamp"),
        "svix-signature": request.headers.get("svix-signature"),
    }

    try:
        wh.verify(payload, headers)
    except WebhookVerificationError:
        return "Invalid signature", 400

    event = json.loads(payload)  # parse setelah signature valid

    if event["type"] == "sales.persisted":
        # Kirim ke queue (misalnya Celery atau RQ), jangan proses di sini
        print("Transaksi diterima:", headers["svix-id"], event["data"]["id"])

    return "", 204