POST https://api.syncra.money/api/v1/p2p/merchant/deals/payin

# 1. Generate an idempotency_key (UUID v4) — it must be unique per payment.
IDEMPOTENCY_KEY=$(uuidgen | tr 'A-Z' 'a-z')

# 2. The request body exactly as it goes on the wire (no extra whitespace).
BODY='{"amount":150000,"currency":"RUB","idempotency_key":"'"$IDEMPOTENCY_KEY"'","client_id":"player_9921","payment_method_id":"<UUID or slug from GET /payment-methods>"}'

# 3. Compute the HMAC-SHA256 signature.
SECRET='whsec_your_webhook_secret_here'
TOKEN='mtoken_your_merchant_token_here'
TS=$(date +%s)
SIG=$(printf '%s.%s' "$TS" "$BODY" | openssl dgst -sha256 -hmac "$SECRET" | awk '{print $2}')

# 4. Send the request.
curl -X POST https://api.syncra.money/api/v1/p2p/merchant/deals/payin \
  -H "X-Merchant-Token: $TOKEN" \
  -H "X-Signature: t=$TS,v1=$SIG" \
  -H "Content-Type: application/json" \
  -d "$BODY"

{
  "deal": {
    "deal_id": "7ac148fe-19a3-45bb-b992-019fac55b721",
    "status": "ESCROW_LOCKED",
    "amount": "150000",
    "currency": "RUB",
    "payment_url": "https://checkout.syncra.money/pay/a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4e5f6a1b2",
    "created_at": "2026-08-03T12:00:00Z"
  }
}

// webhook.js — run with: node webhook.js (requires express: npm i express)
const crypto = require('crypto');
const express = require('express');

const WEBHOOK_SECRET = 'whsec_your_webhook_secret_here';
const app = express();

// IMPORTANT: the signature is computed over the RAW body. Intercept the body
// before JSON parsing and keep it as rawBody.
app.use('/callbacks/syncra', express.raw({ type: 'application/json' }));

app.post('/callbacks/syncra', (req, res) => {
  const rawBody = req.body.toString('utf8');            // the raw body as a string
  const signatureHeader = req.get('X-Signature'); // t=...,v1=...

  // 1. Verify the V2 signature.
  if (!verifySignature(rawBody, signatureHeader, WEBHOOK_SECRET)) {
    return res.status(401).json({ error: 'invalid signature' });
  }

  // 2. Parse the body ONLY after the signature check passes.
  const event = JSON.parse(rawBody);

  // 3. Handle the event. IMPORTANT: return 200 as fast as possible — move
  //    heavy logic (crediting the deposit) to a background queue.
  if (event.event === 'deal.completed') {
    console.log(`Deposit confirmed: deal=${event.deal_id} amount=${event.amount}`);
    // creditPlayer(event.deal_id, event.amount); // your business logic
  }

  // 4. Return 200 — otherwise Syncra will retry the webhook.
  res.status(200).json({ status: 'success' });
});

// HMAC-SHA256 verification for the t={ts},v1={hex} format
function verifySignature(rawBody, signatureHeader, secret) {
  if (!signatureHeader) return false;
  const tsPart = signatureHeader.split(',').find(p => p.startsWith('t='));
  const sigPart = signatureHeader.split(',').find(p => p.startsWith('v1='));
  if (!tsPart || !sigPart) return false;

  const timestamp = tsPart.substring(2);
  const provided = sigPart.substring(3);

  // Replay protection: reject requests older than 5 minutes.
  const age = Math.abs(Math.floor(Date.now() / 1000) - parseInt(timestamp, 10));
  if (age > 300) return false;

  const expected = crypto
    .createHmac('sha256', secret)
    .update(`${timestamp}.${rawBody}`)
    .digest('hex');

  // Timing-safe comparison.
  return crypto.timingSafeEqual(
    Buffer.from(provided, 'utf8'),
    Buffer.from(expected, 'utf8'),
  );
}

app.listen(3000, () => console.log('Webhook server on :3000'));