Postbacks

cURL

# Check a postback by hand: the header must equal "sha256=" + HMAC-SHA256(raw body, your postback secret).
antpay_postback_signature() {   # antpay_postback_signature FILE_WITH_RAW_BODY
  printf 'sha256=%s\n' "$(antpay_hmac_hex "$POSTBACK_SECRET" < "$1")"
}

Part of antpay.sh, the complete tested file

Node.js

// A postback is genuine when X-Mint-Signature equals "sha256=" + HMAC-SHA256(raw body, your postback secret).
// rawBody must be the bytes exactly as received (a Buffer), not a re-encoded object.
function verifyPostback(rawBody, signatureHeader, secret = POSTBACK_SECRET) {
  if (!secret || typeof signatureHeader !== 'string') return false;
  const expected = 'sha256=' + crypto.createHmac('sha256', secret).update(rawBody).digest('hex');
  const got = Buffer.from(signatureHeader);
  const want = Buffer.from(expected);
  return got.length === want.length && crypto.timingSafeEqual(got, want);
}

Part of antpay.js, the complete tested file

PHP

// A postback is genuine when X-Mint-Signature equals "sha256=" + HMAC-SHA256(raw body, your postback secret).
// $rawBody must be the bytes exactly as received (file_get_contents('php://input')), not a re-encoded array.
function antpay_verify_postback(string $rawBody, ?string $signatureHeader, ?string $secret = null): bool {
    $secret = $secret ?? ANTPAY_POSTBACK_SECRET;
    if ($secret === '' || !is_string($signatureHeader)) return false;
    $expected = 'sha256=' . hash_hmac('sha256', $rawBody, $secret);
    return hash_equals($expected, $signatureHeader);
}

Part of antpay.php, the complete tested file

Python

# A postback is genuine when X-Mint-Signature equals "sha256=" + HMAC-SHA256(raw body, your postback secret).
# raw_body must be the bytes exactly as received, not a re-encoded object.
def verify_postback(raw_body, signature_header, secret=None):
    secret = POSTBACK_SECRET if secret is None else secret
    if not secret or not isinstance(signature_header, str):
        return False
    expected = "sha256=" + hmac.new(secret.encode(), raw_body, hashlib.sha256).hexdigest()
    return hmac.compare_digest(expected, signature_header)

Part of antpay.py, the complete tested file

cURL

# Test YOUR postback URL before go-live: send it a postback signed with your own postback secret.
antpay_send_test_postback() {   # antpay_send_test_postback YOUR_URL FILE_WITH_JSON_BODY
  curl -sS -X POST "$1" -H 'Content-Type: application/json' \
    -H "X-Mint-Signature: $(antpay_postback_signature "$2")" --data-binary "@$2" -w '\n%{http_code}\n'
}

Part of antpay.sh, the complete tested file

Node.js

// Step 4: receive the postback. Verify, record once, answer 2xx within 10 seconds.
// onResult(payload) is YOUR function: it must be safe to call twice with the same transactionId + status.
const MAX_POSTBACK_BYTES = 1024 * 1024;                  // a postback is a few kB; refuse anything huge
function postbackServer(onResult) {
  return http.createServer((req, res) => {
    const chunks = [];
    let size = 0;
    req.on('data', (c) => {
      size += c.length;
      if (size > MAX_POSTBACK_BYTES) { res.writeHead(413).end(); req.destroy(); return; }
      chunks.push(c);
    });
    req.on('end', async () => {
      if (size > MAX_POSTBACK_BYTES) return;
      const raw = Buffer.concat(chunks);
      if (!verifyPostback(raw, req.headers['x-mint-signature'])) {
        res.writeHead(401).end();                        // not from AntPay, or the body was changed
        return;
      }
      const p = JSON.parse(raw.toString('utf8'));
      try {
        // p.status is "completed" or "failed" (never "pending"). Find your order by p.checkoutId: the id you
        // stored when you created the checkout. Do not match on p.reference alone.
        await onResult(p);
        res.writeHead(200).end('ok');
      } catch (e) {
        res.writeHead(500).end();                        // we try again: 3 attempts in total, 5 s apart
      }
    });
  });
}

Part of antpay.js, the complete tested file

PHP

// Step 4: receive the postback (this is the body of your postback URL, e.g. postback.php).
// Verify, record once, answer 2xx within 10 seconds.
function antpay_handle_postback(callable $onResult): void {
    $raw = file_get_contents('php://input');
    if (!antpay_verify_postback($raw, $_SERVER['HTTP_X_MINT_SIGNATURE'] ?? null)) {
        http_response_code(401);            // not from AntPay, or the body was changed
        return;
    }
    $p = json_decode($raw, true);
    try {
        // $p['status'] is "completed" or "failed" (never "pending"). Find your order by $p['checkoutId']: the id you
        // stored when you created the checkout. Do not match on the reference alone.
        // $onResult must be safe to call twice with the same transactionId + status.
        $onResult($p);
        http_response_code(200);
        echo 'ok';
    } catch (Throwable $e) {
        http_response_code(500);            // we try again: 3 attempts in total, 5 s apart
    }
}

Part of antpay.php, the complete tested file

Python

# Step 4: receive the postback. Verify, record once, answer 2xx within 10 seconds.
# on_result(payload) is YOUR function: it must be safe to call twice with the same transactionId + status.
def postback_handler(on_result):
    class Handler(BaseHTTPRequestHandler):
        def do_POST(self):
            raw = self.rfile.read(int(self.headers.get("Content-Length", "0")))
            if not verify_postback(raw, self.headers.get("X-Mint-Signature")):
                self.send_response(401)     # not from AntPay, or the body was changed
                self.end_headers()
                return
            p = json.loads(raw.decode("utf-8"))
            try:
                # p["status"] is "completed" or "failed" (never "pending"). Find your order by p["checkoutId"]:
                # the id you stored when you created the checkout. Do not match on the reference alone.
                on_result(p)
                self.send_response(200)
            except Exception:
                self.send_response(500)     # we try again: 3 attempts in total, 5 s apart
            self.end_headers()

        def log_message(self, *args):
            pass
    return Handler

Part of antpay.py, the complete tested file

cURL

# Test YOUR postback URL before go-live: send it a postback signed with your own postback secret.
antpay_send_test_postback() {   # antpay_send_test_postback YOUR_URL FILE_WITH_JSON_BODY
  curl -sS -X POST "$1" -H 'Content-Type: application/json' \
    -H "X-Mint-Signature: $(antpay_postback_signature "$2")" --data-binary "@$2" -w '\n%{http_code}\n'
}

Part of antpay.sh, the complete tested file