Webhooks Overview

curl -X POST https://api.cwmpay.in/api/merchant/{payment}/create \ // ({payment} here can be either "inr" or "crypto")
  -H "x-api-key: YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "amount": 499,
    "currency": "INR",
    "webhookUrl": "https://yoursite.com/webhook"
  }'

{
  "event": "payment.success",
  "timestamp": 1784798913288,
  "data": {
    "orderId": "CWMPay_1784798312415_04575dc339d7",
    "amount": 499,
    "finalAmount": 499.37,
    "currency": "inr",
    "status": "success",
    "utr": "123456789012",
    "txHash": null,
    "completedAt": 1784798913288,
    "customer": {
      "name": "Rahul Sharma",
      "email": "rahul@example.com",
      "phone": "9876543210"
    }
  }
}

// Express.js example
const crypto = require('crypto');

app.post('/webhook', express.raw({ type: 'application/json' }), (req, res) => {
  // Step 1 — Verify signature
  const signature = req.headers['x-cwmpay-signature'];
  const expectedSignature = 'sha256=' + crypto
    .createHmac('sha256', process.env.CWMPAY_WEBHOOK_SECRET)
    .update(JSON.stringify(req.body))
    .digest('hex');

  if (signature !== expectedSignature) {
    return res.status(401).json({ error: 'Invalid signature' });
  }

  // Step 2 — Parse payload
  const payload = req.body;

  // Step 3 — Handle event
  if (payload.event === 'payment.success') {
    const { orderId, amount, utr } = payload.data;
    // Update your database, fulfill order, etc.
    console.log(`Payment confirmed: ${orderId}, Amount: ${amount}, UTR: ${utr}`);
  }

  // Step 4 — Return 200 quickly
  res.status(200).json({ received: true });
});