Merchant Onboarding

import crypto from "node:crypto";

function signRequest({ apiSecret, method, path, body }) {
  const timestamp = new Date().toISOString().replace(/\.\d+Z$/, "Z"); // RFC3339
  const nonce = crypto.randomUUID();
  const rawBody = JSON.stringify(body);

  const stringToSign = [method.toUpperCase(), path, timestamp, nonce, rawBody].join("\n");
  const signature = crypto
    .createHmac("sha256", apiSecret)
    .update(stringToSign)
    .digest("hex"); // lowercase hex

  return { timestamp, nonce, rawBody, signature };
}

// usage
const { timestamp, nonce, rawBody, signature } = signRequest({
  apiSecret: process.env.FAIRA_API_SECRET,
  method: "POST",
  path: "/api/v1/sessions/initiate",
  body: { merchant_id: "1111...", transaction: { amount: 10000, currency: "GBP" } },
});

await fetch("https://api.faira.io/api/v1/sessions/initiate", {
  method: "POST",
  headers: {
    "Content-Type": "application/json",
    "X-Merchant-Id": "11111111-2222-3333-4444-555555555555",
    "X-Api-Key": process.env.FAIRA_API_KEY,
    "X-Timestamp": timestamp,
    "X-Nonce": nonce,
    "X-Signature": signature,
  },
  body: rawBody, // send the exact bytes that were signed
});

import hmac, hashlib, json, uuid
from datetime import datetime, timezone

def sign_request(api_secret: str, method: str, path: str, body: dict):
    timestamp = datetime.now(timezone.utc).strftime("%Y-%m-%dT%H:%M:%SZ")
    nonce = str(uuid.uuid4())
    raw_body = json.dumps(body, separators=(",", ":"))

    string_to_sign = "\n".join([method.upper(), path, timestamp, nonce, raw_body])
    signature = hmac.new(
        api_secret.encode(), string_to_sign.encode(), hashlib.sha256
    ).hexdigest()  # lowercase hex

    return timestamp, nonce, raw_body, signature

func signRequest(apiSecret, method, path, timestamp, nonce string, body []byte) string {
	payload := strings.Join([]string{
		strings.ToUpper(method),
		path,
		timestamp,
		nonce,
		string(body),
	}, "\n")
	mac := hmac.New(sha256.New, []byte(apiSecret))
	mac.Write([]byte(payload))
	return hex.EncodeToString(mac.Sum(nil))
}

import crypto from "node:crypto";

function verifyFairaWebhook(secret, req) {
  const timestamp = req.headers["faira-webhook-timestamp"];
  const signature = req.headers["faira-webhook-signature"];
  const rawBody = req.rawBody; // the raw bytes, NOT a re-serialized object

  const expected =
    "sha256=" +
    crypto.createHmac("sha256", secret)
      .update(timestamp + "." + rawBody)
      .digest("hex");

  const ok =
    signature &&
    crypto.timingSafeEqual(Buffer.from(expected), Buffer.from(signature));

  // Reject stale deliveries to limit replay risk
  const ageSeconds = Math.abs(Date.now() / 1000 - Number(timestamp));
  return ok && ageSeconds < 300;
}

import hmac, hashlib, time

def verify_faira_webhook(secret: str, timestamp: str, signature: str, raw_body: bytes) -> bool:
    mac = hmac.new(secret.encode(), (timestamp + ".").encode() + raw_body, hashlib.sha256)
    expected = "sha256=" + mac.hexdigest()
    if not hmac.compare_digest(expected, signature):
        return False
    return abs(time.time() - int(timestamp)) < 300  # reject stale timestamps

func verifyFairaWebhook(secret, timestamp, signature string, body []byte) bool {
	mac := hmac.New(sha256.New, []byte(secret))
	mac.Write([]byte(timestamp))
	mac.Write([]byte("."))
	mac.Write(body)
	expected := "sha256=" + hex.EncodeToString(mac.Sum(nil))
	return hmac.Equal([]byte(expected), []byte(signature))
}