Webhooks

{
  "id": "evt_01926e2b-4c1f-7a3d-8e52-9b0f4d6c2a17",
  "type": "order.completed",
  "created_at": "2026-09-26T16:47:30Z",
  "livemode": true,
  "data": {
    "id": 58213,
    "object": "order",
    "service": {
      "id": 1001,
      "name": "Instagram Followers",
      "platform": "instagram"
    },
    "link": "https://www.instagram.com/yourbrand",
    "quantity": 1000,
    "status": "completed",
    "start_count": 18420,
    "delivered": 1000,
    "remains": 0,
    "rate": "2.4000",
    "charge": "2.4000",
    "refunded": "0.0000",
    "currency": "USD",
    "runs": null,
    "interval": null,
    "cancel_requested": false,
    "can_cancel": true,
    "refill": {
      "available": true,
      "until": "2026-11-25T16:47:30Z"
    },
    "livemode": true,
    "created_at": "2026-09-26T14:02:11Z",
    "started_at": "2026-09-26T14:09:40Z",
    "completed_at": "2026-09-26T16:47:30Z",
    "updated_at": "2026-09-26T16:47:30Z"
  }
}

{
  "id": "evt_01928a10-77d2-7b0e-a4c3-51e6f09d2b84",
  "type": "refill.completed",
  "created_at": "2026-10-08T15:40:27Z",
  "livemode": true,
  "data": {
    "id": 912,
    "object": "refill",
    "order": 58214,
    "status": "completed",
    "created_at": "2026-10-08T09:15:03Z",
    "completed_at": "2026-10-08T15:40:27Z"
  }
}

# type is price, paused or resumed; new_rate is the new list price per 1,000
# (before your discount), or null
{
  "id": "evt_01926f40-1b9a-7c55-9d21-7e3a8c0b5f63",
  "type": "service.changed",
  "created_at": "2026-09-26T14:00:00Z",
  "livemode": true,
  "data": {
    "service": {
      "id": 1001,
      "name": "Instagram Followers"
    },
    "type": "price",
    "message": "$2.4000 → $2.6400 per 1K from 28 Sep, 14:00 UTC",
    "new_rate": "2.6400",
    "effective_at": "2026-09-28T14:00:00Z"
  }
}

{
  "id": "evt_01926e31-9f07-7d4b-b6a8-2c5d7e1f0a39",
  "type": "balance.low",
  "created_at": "2026-09-26T14:02:11Z",
  "livemode": true,
  "data": {
    "balance": "8.1000",
    "threshold": "10.0000",
    "currency": "USD"
  }
}

import crypto from 'node:crypto'

// rawBody: the request body exactly as received (string or Buffer), before any JSON parsing
export function verifyOrbismm(rawBody, header, secret, toleranceSeconds = 300) {
  const parts = Object.fromEntries(header.split(',').map((p) => p.trim().split('=', 2)))
  const t = Number(parts.t)
  if (!t || Math.abs(Date.now() / 1000 - t) > toleranceSeconds) return false
  const expected = crypto.createHmac('sha256', secret).update(`${t}.${rawBody}`).digest('hex')
  const given = Buffer.from(parts.v1 ?? '')
  return given.length === expected.length && crypto.timingSafeEqual(given, Buffer.from(expected))
}

// Express: keep the raw body for this route
app.post('/orbismm', express.raw({ type: 'application/json' }), (req, res) => {
  if (!verifyOrbismm(req.body, req.get('Orbismm-Signature') ?? '', process.env.ORBISMM_WEBHOOK_SECRET)) {
    return res.sendStatus(400)
  }
  const event = JSON.parse(req.body)
  res.sendStatus(200) // answer first, then do the work
  handle(event)
})

<?php

function verify_orbismm(string $body, string $header, string $secret, int $tolerance = 300): bool
{
    $parts = [];
    foreach (explode(',', $header) as $pair) {
        [$k, $v] = array_pad(explode('=', trim($pair), 2), 2, '');
        $parts[$k] = $v;
    }
    $t = (int) ($parts['t'] ?? 0);
    if ($t === 0 || abs(time() - $t) > $tolerance) {
        return false;
    }

    return hash_equals(hash_hmac('sha256', "{$t}.{$body}", $secret), $parts['v1'] ?? '');
}

$body = file_get_contents('php://input');
if (! verify_orbismm($body, $_SERVER['HTTP_ORBISMM_SIGNATURE'] ?? '', getenv('ORBISMM_WEBHOOK_SECRET'))) {
    http_response_code(400);
    exit;
}
$event = json_decode($body, true);

import hashlib
import hmac
import time


def verify_orbismm(body: bytes, header: str, secret: str, tolerance: int = 300) -> bool:
    parts = dict(p.strip().split("=", 1) for p in header.split(",") if "=" in p)
    t = int(parts["t"]) if parts.get("t", "").isdigit() else 0
    if t == 0 or abs(time.time() - t) > tolerance:
        return False
    expected = hmac.new(secret.encode(), f"{t}.".encode() + body, hashlib.sha256).hexdigest()
    return hmac.compare_digest(expected, parts.get("v1", ""))


# Flask
@app.post("/orbismm")
def orbismm():
    if not verify_orbismm(request.get_data(), request.headers.get("Orbismm-Signature", ""), os.environ["ORBISMM_WEBHOOK_SECRET"]):
        abort(400)
    event = request.get_json()
    return "", 200