Ahbap Pay API

curl -X POST https://pay.ahbapwallet.org/api/v1/payments \
  -H "X-API-Key: ahb_live_XXXXXXXX" \
  -H "Content-Type: application/json" \
  -H "Idempotency-Key: order-1042" \
  -d '{
    "amount": "25.00",
    "asset": "USDT",
    "external_id": "order-1042",
    "description": "Sipariş #1042",
    "return_url": "https://magazam.com/tesekkurler",
    "metadata": { "customer_id": 881 }
  }'

{
  "success": true,
  "reused": false,
  "data": {
    "id": "AHBAP-7K2Q9-XWMR4-TDH8P-N3FZ6",
    "object": "invoice",
    "status": "pending",
    "asset": "USDT",
    "network": "TRON",
    "token_standard": "TRC20",
    "amount": "25",
    "amount_paid": "0",
    "amount_pending": "0",
    "amount_due": "25",
    "fee_percent": 1,
    "net_credited": "0",
    "deposit_address": "TQ7bW1yYk...9xZ",
    "payment_url": "https://pay.ahbapwallet.org/pay/AHBAP-7K2Q9-XWMR4-TDH8P-N3FZ6",
    "qr_code_url": "https://pay.ahbapwallet.org/pay/AHBAP-7K2Q9-XWMR4-TDH8P-N3FZ6/qr.svg",
    "external_id": "order-1042",
    "expires_at": "2026-10-06T12:30:00.000Z",
    "transactions": []
  }
}

curl https://pay.ahbapwallet.org/api/v1/payments/AHBAP-7K2Q9-XWMR4-TDH8P-N3FZ6 \
  -H "X-API-Key: ahb_live_XXXXXXXX"

curl "https://pay.ahbapwallet.org/api/v1/payments?status=paid&limit=20&offset=0" \
  -H "X-API-Key: ahb_live_XXXXXXXX"

curl -X POST https://pay.ahbapwallet.org/api/v1/payments/AHBAP-7K2Q9-XWMR4-TDH8P-N3FZ6/cancel \
  -H "X-API-Key: ahb_live_XXXXXXXX" \
  -H "Content-Type: application/json" \
  -d '{"reason":"Müşteri vazgeçti"}'

POST https://magazam.com/webhook
X-Ahbap-Event: invoice.paid
X-Ahbap-Delivery: evt_9c1d0e2f3a4b5c6d7e8f9a0b
X-Ahbap-Timestamp: 1791300000
X-Ahbap-Signature: t=1791300000,v1=5d41402abc4b2a76b9719d911017c592...

{
  "id": "evt_9c1d0e2f3a4b5c6d7e8f9a0b",
  "object": "event",
  "type": "invoice.paid",
  "created_at": "2026-10-06T12:04:11.000Z",
  "data": {
    "invoice": { "id": "AHBAP-7K2Q9-XWMR4-TDH8P-N3FZ6", "status": "paid", "amount": "25", "amount_paid": "25", "external_id": "order-1042", "...": "..." }
  }
}

const crypto = require('crypto');

// rawBody: isteğin HAM gövdesi (JSON.parse ÖNCESİ string/Buffer)
function verifyAhbapSignature(rawBody, header, secret) {
  const p = {};
  String(header || '').split(',').forEach(function (kv) {
    const i = kv.indexOf('=');
    if (i > 0) p[kv.slice(0, i).trim()] = kv.slice(i + 1).trim();
  });
  if (!p.t || !p.v1) return false;
  const expected = crypto.createHmac('sha256', secret).update(p.t + '.' + rawBody).digest('hex');
  const a = Buffer.from(expected), b = Buffer.from(p.v1);
  const sigOk = a.length === b.length && crypto.timingSafeEqual(a, b);
  const fresh = Math.abs(Date.now() / 1000 - Number(p.t)) < 300; // 5 dk tekrar-oynatma koruması
  return sigOk && fresh;
}

<?php
function verifyAhbapSignature(string $rawBody, string $header, string $secret): bool {
    $p = [];
    foreach (explode(',', $header) as $kv) {
        [$k, $v] = array_pad(explode('=', $kv, 2), 2, '');
        $p[trim($k)] = trim($v);
    }
    if (empty($p['t']) || empty($p['v1'])) return false;
    $expected = hash_hmac('sha256', $p['t'] . '.' . $rawBody, $secret);
    return hash_equals($expected, $p['v1']) && abs(time() - (int)$p['t']) < 300;
}

$raw = file_get_contents('php://input');
if (!verifyAhbapSignature($raw, $_SERVER['HTTP_X_AHBAP_SIGNATURE'] ?? '', 'whsec_...')) {
    http_response_code(400); exit;
}
$event = json_decode($raw, true);
http_response_code(200);

import hmac, hashlib, time

def verify_ahbap_signature(raw_body: bytes, header: str, secret: str) -> bool:
    p = dict(kv.split("=", 1) for kv in header.split(",") if "=" in kv)
    if "t" not in p or "v1" not in p:
        return False
    msg = (p["t"] + ".").encode() + raw_body
    expected = hmac.new(secret.encode(), msg, hashlib.sha256).hexdigest()
    return hmac.compare_digest(expected, p["v1"]) and abs(time.time() - int(p["t"])) < 300