Webhooklar

Buyurtma tayyor bo'lganda yoki xato bilan tugaganda biz sizning serveringizga HTTP so'rov yuboramiz. Holatni qayta-qayta so'rash shart emas.

Sozlash

Webhook manzilini hisob sozlamalarida belgilang yoki har bir buyurtmada webhook_url bering. Manzil HTTPS bo'lishi shart.

Hodisalar

Yuboriladigan so'rov

{
  "id": "evt_31b0c2",
  "object": "event",
  "type": "order.succeeded",
  "created_at": "2026-10-14T09:41:12Z",
  "data": {
    "id": "ord_8f3a1c9e2b",
    "object": "order",
    "service": "kurs_ishi",
    "status": "succeeded",
    "result": { "files": [ { "id": "fil_77d0a1", "name": "kurs_ishi.docx" } ] },
    "metadata": { "your_order_id": "1001" }
  }
}

Imzoni tekshirish

Har bir so'rovda OsonTopshir-Signature sarlavhasi bor. Uni tekshirmasdan so'rovga ishonmang, aks holda har kim sizning manzilingizga soxta xabar yuborishi mumkin.

OsonTopshir-Signature: t=1760434872,v1=5257a869e7ecebeda32affa62cdca3fa51cad7e77a0e56ff536d0ce8e108d8bd

1. t (vaqt) va v1 (imzo) qiymatlarini ajrating.
2. Imzolanadigan satr: t + "." + xom so'rov tanasi (JSON ni qayta formatlamang).
3. Webhook sirri (whsec_...) bilan HMAC-SHA256 hisoblang va v1 bilan doimiy vaqtda solishtiring.
4. t hozirgi vaqtdan 5 daqiqadan ko'p farq qilsa, rad eting (replay hujumidan himoya).

import hmac, hashlib, time

def verify(raw_body: bytes, header: str, secret: str) -> bool:
    parts = dict(p.split("=", 1) for p in header.split(","))
    t, sig = parts["t"], parts["v1"]
    if abs(time.time() - int(t)) > 300:
        return False
    expected = hmac.new(
        secret.encode(), f"{t}.".encode() + raw_body, hashlib.sha256
    ).hexdigest()
    return hmac.compare_digest(expected, sig)

import crypto from "node:crypto";

export function verify(rawBody, header, secret) {
  const parts = Object.fromEntries(header.split(",").map((p) => p.split("=")));
  if (Math.abs(Date.now() / 1000 - Number(parts.t)) > 300) return false;
  const expected = crypto
    .createHmac("sha256", secret)
    .update(`${parts.t}.${rawBody}`)
    .digest("hex");
  return crypto.timingSafeEqual(Buffer.from(expected), Buffer.from(parts.v1));
}

Javob va qayta urinish

• Qabul qilgach 2xx qaytaring. Og'ir ishni keyinroq bajaring, javob 10 soniyadan oshmasin.
• Javob 2xx bo'lmasa yoki vaqt tugasa, qayta urinamiz: 1 daqiqa, 5 daqiqa, 30 daqiqa, 2 soat, 12 soat (jami 6 urinish).
• Bir hodisa bir necha marta kelishi mumkin. event.id bo'yicha takrorlarni o'tkazib yuboring.
• Hodisalar tartibi kafolatlanmaydi. Zarur bo'lsa, GET /v1/orders/{id} bilan joriy holatni tekshiring.