🔐 Verify webhooks

Finally, if you're using NextJS, you will need to create a route specifically for our webhooks in i.e. /api/webhooks/brixpay. After that, you'll need to go back to our console and create a webhook secret in /dashboard and make sure to copy it and store it somewhere safe, because you cannot access it again. If you loose it, you need to create a new one.

Now put that secret into your .env file:

BRIX_WEBHOOK_SECRET=583a024e2f3887b04b32008b52a5a0e2fc6eadf32dfdf09b8fa68b5a2c3dd46a

Before you can start performing actions based on specific webhooks, you must verify that the incoming requests are from BrixPay. This is done by validating the X-Brix-Signature included in the request headers using the webhook secret you just set up. Here's how you do this in your NextJS API route:

import { NextResponse } from 'next/server';
import crypto from 'crypto';

export async function POST(req) {
    const webhookSecret = process.env.BRIX_WEBHOOK_SECRET;
    const signature = req.headers.get('X-Brix-Signature');
    const body = await req.text();

    const expectedSignature = createHmac(
        "sha256",
        process.env.BRIX_WEBHOOK_SECRET
    ).update(body).digest("hex");

    if (signature !== expectedSignature) {
        return NextResponse.json({ error: 'Invalid signature' }, { status: 401 });
    }

    const event = JSON.parse(body);

    // Handle the webhook event
    console.log('Received event:', event);

    return NextResponse.json({ message: "Webhook received" }, { status: 200 });
}