Hubungkan QRISGate ke website Andadalam 30 menit

{
  "event": "payment.paid",
  "transaction_id": "trx_8f2c4b1a05c67e1f7294b3d0",
  "external_order_id": "INV-1042",
  "base_amount": 150000,
  "unique_code": 247,
  "total_amount": 150247,
  "customer_name": "Budi",
  "paid_at": "2026-10-24T09:15:22.000Z",
  "created_at": "2026-10-24T09:12:40.000Z"
}

<?php
// webhook.php — terima notifikasi pembayaran dari QRISGate
$raw = file_get_contents('php://input');
$signature = $_SERVER['HTTP_X_QRISGATE_SIGNATURE'] ?? '';
$timestamp = $_SERVER['HTTP_X_QRISGATE_TIMESTAMP'] ?? '';

// 1. Tolak replay di luar 5 menit
if (abs(time() - (int) $timestamp) > 300) {
    http_response_code(400);
    exit('Stale timestamp');
}

// 2. Verifikasi HMAC-SHA256
$expected = hash_hmac('sha256', $timestamp . '.' . $raw, getenv('QRISGATE_WEBHOOK_SECRET'));
if (!hash_equals($expected, $signature)) {
    http_response_code(401);
    exit('Invalid signature');
}

// 3. Proses event — payload-nya FLAT, tidak ada wrapper `data`.
$event = json_decode($raw, true);

if ($event['event'] === 'payment.paid') {
    $orderId = $event['external_order_id'];
    // TODO: update pesanan Anda menjadi LUNAS
    // Wajib idempoten — event yang sama bisa dikirim ulang.
    // Gunakan X-QRISGate-Delivery-Id untuk membedakan pengiriman ulang.
}

http_response_code(200);
echo 'OK';