{
  'x-access-signature': 'd2f1c81f2a1fc4182cec0c4360c38ce6cf8bce603a15e6eec5979f6af01363d5',
  'x-access-ts': 1709200638686,
  'x-api-token': 'MY_API_TOKEN'
}

import * as crypto from "crypto";

const generateSignature = (
  rawSignature,
  secret
) => {
  return crypto
    .createHmac("sha256", secret)
    .update(rawSignature)
    .digest("hex");
}

const generateRequestHeaders = () => {
  // populate these values from the env or your config service
  const apiToken = "MY_API_TOKEN";
  const firstSecret = "MY_FIRST_SECRET";

  const timestamp = 1709201276442; // new Date().getTime()
  const rawSignature = `${timestamp}:${apiToken}`;
  const signature = generateSignature(rawSignature, firstSecret);

  return {
    "x-access-signature": signature,
    "x-access-ts": timestamp,
    "x-api-token": apiToken
  };
}

console.log(generateRequestHeaders());

<?php

function generateSignature($rawSignature, $secret) {
  return hash_hmac('sha256', $rawSignature, $secret);
}

function generateRequestHeaders() {
  // populate these values from the env or your config service
  $apiToken = "MY_API_TOKEN";
  $firstSecret = "MY_FIRST_SECRET";
  $timestamp = 1709201276442; // floor(microtime(true) * 1000);
  $rawSignature = $timestamp . ':' . $apiToken;
  $signature = generateSignature($rawSignature, $firstSecret);

  return [
    'x-access-signature' => $signature,
    'x-access-ts' => $timestamp,
    'x-api-token' => $apiToken
  ];
}

print_r(generateRequestHeaders());
?>

using System;
using System.Security.Cryptography;
using System.Text;
using System.Collections.Generic;

class Program
{
  static string GenerateSignature(string rawSignature, string secret)
  {
    using (var hmac = new HMACSHA256(Encoding.UTF8.GetBytes(secret)))
    {
      byte[] signatureBytes = hmac.ComputeHash(Encoding.UTF8.GetBytes(rawSignature));
      return BitConverter.ToString(signatureBytes).Replace("-", "").ToLower();
    }
  }

  static string[] GenerateRequestHeaders()
  {
    // populate these values from the env or your config service
    string apiToken = "MY_API_TOKEN";
    string firstSecret = "MY_FIRST_SECRET";
    long timestamp = 1709201276442; // DateTimeOffset.Now.ToUnixTimeMilliseconds();

    string rawSignature = $"{timestamp}:{apiToken}";
      string signature = GenerateSignature(rawSignature, firstSecret);

      return new string[] {
          $"x-access-signature: {signature}",
          $"x-access-ts: {timestamp}",
          $"x-api-token: {apiToken}"
      };
  }

  static void Main(string[] args)
  {
      string[] headers = GenerateRequestHeaders();
      foreach (string header in headers)
      {
          Console.WriteLine(header);
      }
  }
}

import * as crypto from "crypto";

const generateSignature = (
  rawSignature,
  secret
  ) => {
  return crypto
    .createHmac("sha256", secret)
    .update(rawSignature)
    .digest("hex");
}

const validateSignature = (receivedSignature, receivedPayload) => {
  const secondSecret = "MY_SECOND_SECRET";

  const signature = generateSignature(JSON.stringify(receivedPayload), secondSecret);

  if (receivedSignature === signature) {
    return true;
  }

  return false;
}

const signatureHeaderValue = "c47f8bbe4ba6d2ca418155f3c4e390d2f4484960389275cfd75a952227cd6c12";

const payload = {
  internal_id: 1,
  status: -2,
  amount: '501253',
  is_reprocessed: false,
  target_address: '0000********0000',
  formatted_amount: '5012.53',
  transaction_amount: '501253',
  currency_id: 'RUB',
  method_id: 'CARD_RUB',
  fields_data: { 'card-mask': { value: '4242********4242' } },
  operation_type: 1,
  order_id: 'my_id1'
}

console.log("Is signature valid", validateSignature(signatureHeaderValue, payload));

<?php
  function generateSignature($rawSignature, $secret) {
    return hash_hmac("sha256", $rawSignature, $secret);
  }

  function validateSignature($receivedSignature, $receivedPayload) {
    $secondSecret = "MY_SECOND_SECRET";

    $signature = generateSignature(json_encode($receivedPayload), $secondSecret);

    return $receivedSignature === $signature;
  }

  $signatureHeaderValue = "c47f8bbe4ba6d2ca418155f3c4e390d2f4484960389275cfd75a952227cd6c12";

  $payload = array(
    "internal_id" => 1,
    "status" => -2,
    "amount" => '501253',
    "is_reprocessed" => false,
    "target_address" => '0000********0000',
    "formatted_amount" => '5012.53',
    "transaction_amount" => '501253',
    "currency_id" => 'RUB',
    "method_id" => 'CARD_RUB',
    "fields_data" => array('card-mask' => array("value" => '4242********4242')),
    "operation_type" => 1,
    "order_id" => 'my_id1'
  );

  echo "Is signature valid: " . (validateSignature($signatureHeaderValue, $payload) ? 'true' : 'false');
?>

using System;
using System.Security.Cryptography;
using System.Text;
using Newtonsoft.Json.Linq;

public class SignatureHelper
{
  private static string GenerateSignature(string rawSignature, string secret)
  {
    using (var hmac = new HMACSHA256(Encoding.UTF8.GetBytes(secret)))
    {
      byte[] hash = hmac.ComputeHash(Encoding.UTF8.GetBytes(rawSignature));
      return BitConverter.ToString(hash).Replace("-", "").ToLower();
    }
  }

  private static bool ValidateSignature(string receivedSignature, object receivedPayload)
  {
    const string secondSecret = "MY_SECOND_SECRET";

    string signature = GenerateSignature(Newtonsoft.Json.JsonConvert.SerializeObject(receivedPayload), secondSecret);

    return receivedSignature.Equals(signature, StringComparison.OrdinalIgnoreCase);
  }

  public static void Main(string[] args)
  {
    string signatureHeaderValue = "c47f8bbe4ba6d2ca418155f3c4e390d2f4484960389275cfd75a952227cd6c12";

    var payload = new JObject
    {
      { "internal_id", 1 },
      { "status", -2 },
      { "amount", "501253" },
      { "is_reprocessed", false },
      { "target_address", "0000********0000" },
      { "formatted_amount", "5012.53" },
      { "transaction_amount", "501253" },
      { "currency_id", "RUB" },
      { "method_id", "CARD_RUB" },
      { "fields_data", new JObject
        {
          { "card-mask", new JObject
            {
              { "value", "4242********4242" }
            }
          }
        }
      },
      { "operation_type", 1 },
      { "order_id", "my_id1" }
    };

    Console.WriteLine("Is signature valid: " + ValidateSignature(signatureHeaderValue, payload));
  }
}

[HttpPost("callback-handler")]
public async Task<IActionResult> CallbackHandler()
{
  var signatureHeader = Request.Headers["x-access-signature"];
  var signature = signatureHeader.FirstOrDefault();

  if (string.IsNullOrEmpty(signature))
  {
      return BadRequest("No signature");
  }

  var rawBody = await new StreamReader(Request.Body).ReadToEndAsync();
  var bodyObject = JObject.Parse(rawBody);

  if(!SignatureHelper.ValidateSignature(signature, bodyObject))
  {
      return BadRequest("Invalid signature");
  }

  return Ok("Valid signature");
}

const crypto = require('crypto');

const generateSignature = (
    rawSignature,
    secret
) => {
  return crypto
    .createHmac("sha256", secret)
    .update(rawSignature)
    .digest("hex");
}

const validateSignature = (receivedSignature, receivedPayload) => {
  const secondSecret = "MY_SECOND_SECRET";

  const signature = generateSignature(JSON.stringify(receivedPayload), secondSecret);

  if (receivedSignature === signature) {
    return true;
  }

  return false;
}

const handleRequest = () => {
  const signatureHeaderValue = "c47f8bbe4ba6d2ca418155f3c4e390d2f4484960389275cfd75a952227cd6c12";
  const callbackData = {
    internal_id: 1,
    status: -2,
    amount: '501253',
    is_reprocessed: false,
    target_address: '0000********0000',
    formatted_amount: '5012.53',
    transaction_amount: '501253',
    currency_id: 'RUB',
    method_id: 'CARD_RUB',
    fields_data: { 'card-mask': { value: '4242********4242' } },
    operation_type: 1,
    order_id: 'my_id1'
  }

  const isSignatureValid = validateSignature(signatureHeaderValue, callbackData);

  if (!isSignatureValid) {
    throw new Error("Invalid signature");
  }

  if (callbackData.is_reprocessed) {
    // handle reprocessed payment
    return "ok";
  }

  if (callbackData.status === 0) {
    // handle pending payment
    return "ok";
  }

  if (callbackData.status < 0) {
    // handle failed payment
    return "ok";
  }

  if (callbackData.status >= 100) {
    // handle successful payment
    return "ok";
  }

  throw new Error("Invalid status");
}