Webhooks

POST /webhooks/reasy HTTP/1.1
Host: example.com
Content-Type: application/json
x-reasy-signature: 6d3c2b0d1e9b4a7f0c5f3e9a8d2b1c4e7f6a5b4c3d2e1f0a9b8c7d6e5f4a3b2c

{"id":"2WZF419iKXNzxkE2p9kEJI3knGS","externalId":"order-10042","status":"paid","statusCode":"20000",...}

{
  "id": "2WZF419iKXNzxkE2p9kEJI3knGS",
  "externalId": "order-10042",
  "quotationId": "2WZF3Q9iKXNzxkE2p9kEJI3knGS",
  "callbackUrl": "https://example.com/webhooks/reasy",
  "status": "paid",
  "statusCode": "20000",
  "createdAt": "2026-08-19T10:01:12Z",
  "expiredAt": "2026-08-19T10:15:00Z",
  "sendAmount": 1000000.0,
  "sourceCurrency": "XAF",
  "receiveAmount": 11655.0,
  "destinationCurrency": "CNY",
  "feeCurrency": "XAF",
  "feeAmount": 7000.0,
  "variableFeeAmount": 6000.0,
  "fixedFeeAmount": 1000.0,
  "purposeOfRemittance": "EXPORTED_GOODS",
  "documentReferenceNumber": "INV-10042",
  "sender": null,
  "sendingBusiness": { "registeredName": "Acme Cameroun SARL", "city": "Douala", "countryIsoCode": "CMR", "...": "..." },
  "receiver": null,
  "receivingBusiness": { "registeredName": "PINGYAO SHANGHAI CO., LTD.", "city": "Shanghai", "countryIsoCode": "CHN", "...": "..." },
  "deliveryMethodInfo": { "bankAccountNumber": "6222020200044445555", "bankAccountSwiftCode": "ICBKCNBJ", "bankAccountHolderFullName": "Pingyao Shanghai Co., Ltd.", "...": null }
}

import express from "express";
import { createHmac, timingSafeEqual } from "node:crypto";

const app = express();
const API_KEY = process.env.REASY_API_KEY;

function verifyReasySignature(path, rawBody, signatureHeader) {
  const expected = createHmac("sha256", API_KEY)
    .update(`POST${path}`)
    .update(rawBody)                      // Buffer with the raw request bytes
    .digest("hex");
  const received = Buffer.from(signatureHeader ?? "", "utf8");
  const wanted = Buffer.from(expected, "utf8");
  return received.length === wanted.length && timingSafeEqual(received, wanted);
}

// Keep the raw body: express.json() would re-serialize it and break the signature
app.post("/webhooks/reasy", express.raw({ type: "application/json" }), (req, res) => {
  // req.baseUrl + req.path = full path even when this handler lives in a mounted router
  if (!verifyReasySignature(req.baseUrl + req.path, req.body, req.header("x-reasy-signature"))) {
    return res.status(401).send("invalid signature");
  }
  const transfer = JSON.parse(req.body.toString("utf8"));

  // Acknowledge first, then process (idempotently) — REasy does not retry.
  res.sendStatus(200);

  if (transfer.status === "paid") {
    // mark order `transfer.externalId` as paid
  } else if (transfer.status === "failed") {
    // handle failure, see transfer.statusCode
  }
});

app.listen(3000);

<?php
// webhooks/reasy.php — plain PHP; works the same inside Laravel/Symfony
// (use $request->getContent() / $request->headers->get('x-reasy-signature')).

function verifyReasySignature(string $apiKey, string $path, string $rawBody, ?string $signatureHeader): bool
{
    $expected = hash_hmac('sha256', 'POST' . $path . $rawBody, $apiKey);
    return is_string($signatureHeader) && hash_equals($expected, $signatureHeader);
}

$apiKey    = getenv('REASY_API_KEY');
$rawBody   = file_get_contents('php://input');            // raw bytes, never re-encode
$signature = $_SERVER['HTTP_X_REASY_SIGNATURE'] ?? null;
$path      = parse_url($_SERVER['REQUEST_URI'], PHP_URL_PATH); // e.g. "/webhooks/reasy"

if (!verifyReasySignature($apiKey, $path, $rawBody, $signature)) {
    http_response_code(401);
    exit('invalid signature');
}

$transfer = json_decode($rawBody, true);

// Acknowledge first, then process (idempotently) — REasy does not retry.
http_response_code(200);
if (function_exists('fastcgi_finish_request')) {
    fastcgi_finish_request(); // PHP-FPM only: flushes the 200 now. On other SAPIs the
                              // response is sent when the script ends — keep work < 30 s
                              // or hand it to a queue/job.
}

if ($transfer['status'] === 'paid') {
    // mark order $transfer['externalId'] as paid
} elseif ($transfer['status'] === 'failed') {
    // handle failure, see $transfer['statusCode']
}

import hashlib
import hmac
import json
import os

from flask import Flask, abort, request

app = Flask(__name__)
API_KEY = os.environ["REASY_API_KEY"]


def verify_reasy_signature(path: str, raw_body: bytes, signature_header: str | None) -> bool:
    expected = hmac.new(
        API_KEY.encode(), b"POST" + path.encode() + raw_body, hashlib.sha256
    ).hexdigest()
    return hmac.compare_digest(expected, signature_header or "")


@app.post("/webhooks/reasy")
def reasy_webhook():
    raw_body = request.get_data()  # raw bytes, never re-encode
    path = request.script_root + request.path  # full path, even if the app is mounted under a prefix
    if not verify_reasy_signature(path, raw_body, request.headers.get("x-reasy-signature")):
        abort(401)

    transfer = json.loads(raw_body)

    # Process idempotently — REasy does not retry.
    if transfer["status"] == "paid":
        pass  # mark order transfer["externalId"] as paid
    elif transfer["status"] == "failed":
        pass  # handle failure, see transfer["statusCode"]

    return "", 200

REASY_API_KEY='YOUR_API_KEY'
URL='http://localhost:3000/webhooks/reasy'
BODY='{"id":"2WZF419iKXNzxkE2p9kEJI3knGS","externalId":"order-10042","status":"paid","statusCode":"20000","sendAmount":1000000.0,"sourceCurrency":"XAF","receiveAmount":11655.0,"destinationCurrency":"CNY"}'

PATH_ONLY=$(printf '%s' "$URL" | sed -E 's|^[a-z]+://[^/]+||; s|[?#].*$||'); PATH_ONLY=${PATH_ONLY:-/}
SIGNATURE=$(printf 'POST%s%s' "$PATH_ONLY" "$BODY" | openssl dgst -sha256 -hmac "$REASY_API_KEY" | sed 's/^.* //')

curl -i -X POST "$URL" \
  -H 'content-type: application/json' \
  -H "x-reasy-signature: $SIGNATURE" \
  --data-raw "$BODY"