Skip to content

fix: shop-setup Phase 6 — webhook signature is sha1(body + secret), not HMAC-SHA1 #27

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
JavadManashti merged 1 commit into from
Aug 17, 2026
Merged

fix: shop-setup Phase 6 — webhook signature is sha1(body + secret), not HMAC-SHA1 #27

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 4 additions & 4 deletions .cursor/skills/shop-setup/SKILL.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -200,10 +200,10 @@ detects locale on its own and lets the player change language in the hosted UI.
After a successful payment — whether through Headless Checkout SDK or Pay Station — **Xsolla sends a webhook to the partner's backend**. The partner must:

- Expose an HTTPS endpoint registered in Publisher Account
- Verify the webhook signature (HMAC-SHA1)
- Handle `payment` notification type: extract `user.id` and purchased items
- Grant the item/currency/key in the partner's game system
- Respond `HTTP 200` to acknowledge receipt
- Verify the signature over the **raw** body: `lowercase(sha1(rawBody + secret))`, compared in constant time — plain SHA-1 with the secret **appended**, **not** HMAC-SHA1 → `webhooks-impl`
- Handle the fulfillment event for the token method in use: `order_paid` (Methods 1–2 — items in `items[]`, player in `user.external_id`) or `payment` (Method 3 — items usually in `custom_parameters`, player in `user.id`); when both arrive (separate delivery), grant on `order_paid` only
- Grant the item/currency/key in the partner's game system, idempotently by transaction id
Comment on lines +203 to +205
- Respond `2xx` (`200`/`201`/`204`) to acknowledge receipt; `400` + `INVALID_SIGNATURE` on a mismatch

**This step is required for real-money purchases.** Without it, payment succeeds on Xsolla's side but the player receives nothing in the game.

Expand Down
8 changes: 4 additions & 4 deletions skills/shop-setup/SKILL.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -200,10 +200,10 @@ detects locale on its own and lets the player change language in the hosted UI.
After a successful payment — whether through Headless Checkout SDK or Pay Station — **Xsolla sends a webhook to the partner's backend**. The partner must:

- Expose an HTTPS endpoint registered in Publisher Account
- Verify the webhook signature (HMAC-SHA1)
- Handle `payment` notification type: extract `user.id` and purchased items
- Grant the item/currency/key in the partner's game system
- Respond `HTTP 200` to acknowledge receipt
- Verify the signature over the **raw** body: `lowercase(sha1(rawBody + secret))`, compared in constant time — plain SHA-1 with the secret **appended**, **not** HMAC-SHA1 → `webhooks-impl`
- Handle the fulfillment event for the token method in use: `order_paid` (Methods 1–2 — items in `items[]`, player in `user.external_id`) or `payment` (Method 3 — items usually in `custom_parameters`, player in `user.id`); when both arrive (separate delivery), grant on `order_paid` only
- Grant the item/currency/key in the partner's game system, idempotently by transaction id
Comment on lines +203 to +205
- Respond `2xx` (`200`/`201`/`204`) to acknowledge receipt; `400` + `INVALID_SIGNATURE` on a mismatch

**This step is required for real-money purchases.** Without it, payment succeeds on Xsolla's side but the player receives nothing in the game.

Expand Down
Loading