Вебхуки

pay.webhook.set("https://shop.example/kivix")
pay.webhook.test()   # придёт событие webhook.test

await pay.webhook.set("https://shop.example/kivix");
await pay.webhook.test();

$pay->webhook->set('https://shop.example/kivix');
$pay->webhook->test();

curl -X PUT https://kivix.cc/v1/webhook -H "Authorization: Bearer $KIVIX_PAY_KEY" \
  -H "Content-Type: application/json" -d '{"url":"https://shop.example/kivix"}'
curl -X POST https://kivix.cc/v1/webhook/test -H "Authorization: Bearer $KIVIX_PAY_KEY"

{
  "id": "Qm3xR8vLp2KdT6wZ0c",
  "object": "event",
  "type": "invoice.paid",
  "created_at": "2026-10-26T12:31:05Z",
  "data": { "invoice": { /* объект счёта, status = "paid" */ } }
}

from kivix_pay import construct_event, SignatureVerificationError

@app.post("/kivix")                      # Flask
def kivix_webhook():
    try:
        event = construct_event(request.get_data(), request.headers.get("Kivix-Signature"), WEBHOOK_SECRET)
    except SignatureVerificationError:
        return "", 400
    if event.type == "invoice.paid":
        fulfill(event.data.invoice.order_id)
    return "", 200

import express from "express";
import { constructEvent } from "kivix-pay";

app.post("/kivix", express.raw({ type: "application/json" }), (req, res) => {
  let event;
  try {
    event = constructEvent(req.body, req.get("Kivix-Signature"), process.env.KIVIX_WEBHOOK_SECRET);
  } catch {
    return res.sendStatus(400);
  }
  if (event.type === "invoice.paid") fulfill(event.data.invoice.order_id);
  res.sendStatus(200);
});

use Kivix\Pay\{Webhook, SignatureVerificationException};

try {
    $event = Webhook::constructEvent(file_get_contents('php://input'),
        $_SERVER['HTTP_KIVIX_SIGNATURE'] ?? null, getenv('KIVIX_WEBHOOK_SECRET'));
} catch (SignatureVerificationException) {
    http_response_code(400); exit;
}
if ($event['type'] === 'invoice.paid') {
    fulfill($event['data']['invoice']['order_id']);
}

import hashlib, hmac, time

def verify(raw_body: bytes, header: str, secret: str, tolerance: int = 300) -> bool:
    parts = dict(item.split("=", 1) for item in header.split(","))
    timestamp, signature = parts.get("t", ""), parts.get("v1", "")
    if not timestamp.isdigit() or abs(time.time() - int(timestamp)) > tolerance:
        return False
    expected = hmac.new(secret.encode(), f"{timestamp}.".encode() + raw_body, hashlib.sha256).hexdigest()
    return hmac.compare_digest(expected, signature)

import crypto from "node:crypto";

function verify(rawBody, header, secret, tolerance = 300) {
  const parts = Object.fromEntries(header.split(",").map((p) => p.split("=")));
  const t = Number(parts.t);
  if (!t || Math.abs(Date.now() / 1000 - t) > tolerance) return false;
  const expected = crypto.createHmac("sha256", secret).update(`${parts.t}.`).update(rawBody).digest("hex");
  return parts.v1?.length === expected.length &&
    crypto.timingSafeEqual(Buffer.from(expected), Buffer.from(parts.v1));
}

$raw = file_get_contents('php://input');
parse_str(str_replace(',', '&', $_SERVER['HTTP_KIVIX_SIGNATURE'] ?? ''), $parts);
$t = $parts['t'] ?? '';
$expected = hash_hmac('sha256', $t . '.' . $raw, getenv('KIVIX_WEBHOOK_SECRET'));
$ok = ctype_digit($t) && abs(time() - (int) $t) <= 300 && hash_equals($expected, $parts['v1'] ?? '');