ويب هوك

{
  "id": "4821",
  "event": "order.placed",
  "createdAt": "2026-08-09T18:20:11.004Z",
  "shop": { "slug": "aleppo-textiles", "token": "aleppo-textiles-token" },
  "data": { "code": "MS2408-0042", "totalWithTax": 185000, "currencyCode": "SYP" }
}

// Node — verify an eMatjarak webhook
import crypto from 'node:crypto';

function verify(rawBody, headers, secret) {
  const signature = headers['x-ms-signature'];
  const timestamp = headers['x-ms-timestamp'];
  if (!signature || !timestamp) return false;

  // Reject anything older than five minutes: a signature over the body alone
  // could be replayed forever, which is why the timestamp is signed too.
  if (Math.abs(Date.now() - Number(timestamp)) > 5 * 60 * 1000) return false;

  const expected =
    'sha256=' +
    crypto.createHmac('sha256', secret).update(`${timestamp}.${rawBody}`).digest('hex');

  return crypto.timingSafeEqual(Buffer.from(expected), Buffer.from(signature));
}

<?php
// PHP — verify an eMatjarak webhook
function ms_verify(string $rawBody, array $headers, string $secret): bool {
    $signature = $headers['x-ms-signature'] ?? '';
    $timestamp = $headers['x-ms-timestamp'] ?? '';
    if ($signature === '' || $timestamp === '') return false;

    if (abs(time() * 1000 - (int) $timestamp) > 5 * 60 * 1000) return false;

    $expected = 'sha256=' . hash_hmac('sha256', $timestamp . '.' . $rawBody, $secret);
    return hash_equals($expected, $signature);
}