Taliup PHP SDK Webhook Class — Signature Verification

Webhook::constructEvent(string $payload, string $signature, string $secret): array

<?php

require __DIR__ . '/vendor/autoload.php';

use Taliup\Sdk\Exceptions\ApiException;
use Taliup\Sdk\Webhook;

$secret    = getenv('TALIUP_MERCHANT_SECRET_KEY');
$payload   = file_get_contents('php://input');
$signature = $_SERVER['HTTP_X_TALIUP_SIGNATURE'] ?? '';

try {
    $event = Webhook::constructEvent($payload, $signature, $secret);
} catch (ApiException $e) {
    // 401 → invalid signature, 400 → bad JSON
    http_response_code($e->getStatusCode());
    exit($e->getMessage());
}

// Safe to process the event
$reference = $event['reference'];  // Your order ID
$status    = $event['status'];     // 'approved', 'declined', etc.

if ($status === 'approved') {
    // Mark the order as paid in your database
}

http_response_code(200);
echo json_encode(['received' => true]);

Webhook::verify(string $payload, string $signature, string $secret): bool

<?php

use Taliup\Sdk\Webhook;

$isValid = Webhook::verify(
    file_get_contents('php://input'),
    $_SERVER['HTTP_X_TALIUP_SIGNATURE'] ?? '',
    getenv('TALIUP_MERCHANT_SECRET_KEY')
);

if (!$isValid) {
    http_response_code(401);
    exit('Invalid signature.');
}

// Decode and handle the payload yourself
$event = json_decode(file_get_contents('php://input'), true);

{
    "event":              "payment.captured",
    "merchant_site_id":   "your_merchant_site_id",
    "transaction_id":     "abc123",
    "amount":             "49.99",
    "currency":           "CAD",
    "status":             "approved",
    "card_type":          "VISA",
    "card_number_masked": "41**********1111",
    "reference":          "ORDER-10029",
    "timestamp":          "2026-05-14T18:00:00+00:00"
}