Вебхуки

{
  "id": "evt_3Lm8Qz1VbN6cX2wR9tKp4HsD",
  "object": "event",
  "type": "payment.succeeded",
  "livemode": true,
  "project_id": "prj_7HcTq2LwZ9mRk4VbN1sXe8Dy",
  "created": 1792922592,
  "data": {
    "object": {
      "id": "pay_8Rt2XvL5nQ1mZ7cK4wB9pJ3s",
      "object": "payment",
      "livemode": true,
      "project_id": "prj_7HcTq2LwZ9mRk4VbN1sXe8Dy",
      "type": "qr",
      "status": "succeeded",
      "amount": 2500,
      "amount_refunded": 0,
      "currency": "KZT",
      "description": "Кофе и круассан",
      "phone": null,
      "external_id": "pos-77-1029",
      "metadata": {},
      "checkout_url": "https://pay.sezgir.com/pay/pay_8Rt2XvL5nQ1mZ7cK4wB9pJ3s",
      "provider": {
        "name": "kaspi",
        "operation_id": "18734512",
        "kind": "qr",
        "status": "Processed",
        "qr_url": "https://pay.kaspi.kz/pay/fT9kq2Lx7mWc",
        "qr_expires_at": "2026-10-25T10:05:41.000Z"
      },
      "failure_reason": null,
      "requires_review": false,
      "expires_at": "2026-10-25T10:06:41.000Z",
      "paid_at": "2026-10-25T10:03:12.881Z",
      "canceled_at": null,
      "created_at": "2026-10-25T10:02:41.204Z"
    }
  }
}

{
  "id": "evt_9QwE2rT5yU8iO1pA4sD7fG0h",
  "object": "event",
  "type": "webhook.test",
  "livemode": false,
  "project_id": "prj_7HcTq2LwZ9mRk4VbN1sXe8Dy",
  "created": 1792922592,
  "data": {
    "object": {
      "message": "Тестовое событие Sezgir Pay",
      "endpoint_id": "we_6YhN3bV8cX1zL4kJ7mQ2wE5r"
    }
  }
}

Sezgir-Signature: t=1792922592,v1=5f2b8e…c41a

v1 = hex( HMAC_SHA256( key = "whsec_…", message = t + "." + raw_body ) )

import crypto from 'node:crypto';
import express from 'express';

const SECRET = process.env.SEZGIR_WEBHOOK_SECRET; // whsec_… целиком, вместе с префиксом
const TOLERANCE_SEC = 300; // отклоняем подписи старше 5 минут

function verifySignature(rawBody, header) {
  const parts = Object.fromEntries(
    String(header ?? '').split(',').map((p) => p.trim().split('=')),
  );
  const t = Number(parts.t);
  if (!Number.isInteger(t) || !parts.v1) return false;
  if (Math.abs(Date.now() / 1000 - t) > TOLERANCE_SEC) return false;

  const expected = crypto.createHmac('sha256', SECRET).update(`${t}.${rawBody}`).digest('hex');
  const a = Buffer.from(expected);
  const b = Buffer.from(parts.v1);
  return a.length === b.length && crypto.timingSafeEqual(a, b);
}

const app = express();

// Подпись считается от исходных байтов тела — не пропускайте его через express.json()
app.post('/webhooks/sezgir', express.raw({ type: 'application/json' }), async (req, res) => {
  const raw = req.body.toString('utf8');
  if (!verifySignature(raw, req.get('Sezgir-Signature'))) {
    return res.status(400).send('invalid signature');
  }

  const event = JSON.parse(raw);
  // INSERT … ON CONFLICT (id) DO NOTHING — повторная доставка не обработается дважды
  const isNew = await saveEventOnce(event);
  res.sendStatus(200); // отвечаем сразу, тяжёлую работу — в фон
  if (isNew) await queue.add('sezgir-event', { id: event.id });
});

app.listen(3000);

async function handleEvent(event) {
  const obj = event.data.object;
  switch (event.type) {
    case 'payment.succeeded':
      // Может прийти и после expired/canceled — заказ всё равно оплачен
      await orders.markPaid(obj.external_id, { paymentId: obj.id, amount: obj.amount });
      break;
    case 'payment.failed':
    case 'payment.expired':
    case 'payment.canceled':
      await orders.markUnpaid(obj.external_id, obj.status); // не удаляйте заказ
      break;
    case 'payment.refunded':
      await orders.setRefunded(obj.external_id, obj.amount_refunded, obj.status);
      break;
    case 'refund.succeeded':
    case 'refund.failed':
      await refunds.update(obj.id, obj.status);
      break;
    default:
      // webhook.test и типы, появившиеся позже, — просто подтверждаем
  }
}

curl "https://pay.sezgir.com/api/v1/events?type=payment.succeeded&limit=50" \
  -H "Authorization: Bearer $SEZGIR_API_KEY"

{
  "object": "list",
  "data": [
    {
      "id": "evt_3Lm8Qz1VbN6cX2wR9tKp4HsD",
      "object": "event",
      "type": "payment.succeeded",
      "livemode": true,
      "project_id": "prj_7HcTq2LwZ9mRk4VbN1sXe8Dy",
      "created": 1792922592,
      "data": {
        "object": {
          "id": "pay_8Rt2XvL5nQ1mZ7cK4wB9pJ3s",
          "object": "payment",
          "livemode": true,
          "project_id": "prj_7HcTq2LwZ9mRk4VbN1sXe8Dy",
          "type": "qr",
          "status": "succeeded",
          "amount": 2500,
          "amount_refunded": 0,
          "currency": "KZT",
          "description": "Кофе и круассан",
          "phone": null,
          "external_id": "pos-77-1029",
          "metadata": {},
          "checkout_url": "https://pay.sezgir.com/pay/pay_8Rt2XvL5nQ1mZ7cK4wB9pJ3s",
          "provider": {
            "name": "kaspi",
            "operation_id": "18734512",
            "kind": "qr",
            "status": "Processed",
            "qr_url": "https://pay.kaspi.kz/pay/fT9kq2Lx7mWc",
            "qr_expires_at": "2026-10-25T10:05:41.000Z"
          },
          "failure_reason": null,
          "requires_review": false,
          "expires_at": "2026-10-25T10:06:41.000Z",
          "paid_at": "2026-10-25T10:03:12.881Z",
          "canceled_at": null,
          "created_at": "2026-10-25T10:02:41.204Z"
        }
      }
    }
  ],
  "has_more": true
}