const crypto = require('crypto');

// All fields come directly from the flat POST body
const hashString =
    String(req.body.merchant_id  ?? '') +
    String(req.body.order_ref    ?? '') +
    String(req.body.user_fullname ?? '') +
    String(req.body.invoice_mail ?? '') +
    String(req.body.gateway_name ?? '') +
    String(req.body.status       ?? '') +
    API_KEY;

const expected = Buffer
    .from(crypto.createHmac('sha256', API_SECRET).update(hashString).digest())
    .toString('base64');

// timingSafeEqual prevents timing attacks
const a = Buffer.from(req.body.hash ?? '');
const b = Buffer.from(expected);
if (a.length !== b.length || !crypto.timingSafeEqual(a, b)) {
    return res.status(403).send('invalid_hash');
}

import hmac, hashlib, base64
from flask import request

API_KEY    = 'YOUR_API_KEY'
API_SECRET = 'YOUR_API_SECRET'

# All fields come directly from the flat POST body
f = lambda k: request.form.get(k, '')
hash_string = (
    f('merchant_id')  +
    f('order_ref')    +
    f('user_fullname') +
    f('invoice_mail') +
    f('gateway_name') +
    f('status')       +
    API_KEY
)

expected = base64.b64encode(
    hmac.new(API_SECRET.encode(), hash_string.encode(), hashlib.sha256).digest()
).decode()

# compare_digest prevents timing attacks
if not hmac.compare_digest(f('hash'), expected):
    abort(403)

const https  = require('https');
const qs     = require('querystring');
const crypto = require('crypto');

const API_KEY    = 'YOUR_API_KEY';
const API_SECRET = 'YOUR_API_SECRET';
const store_id   = 12345;
const user_id    = 678;
const username   = 'username';
const user_email = '[email protected]';

const hash = Buffer
    .from(crypto.createHmac('sha256', API_SECRET)
        .update(String(API_KEY) + '|' + String(store_id) + '|' + String(user_id) + '|' + username + '|' + user_email)
        .digest())
    .toString('base64');

const body = qs.stringify({
    api_key:       API_KEY,
    hash:          hash,
    store_id:      store_id,
    user_id:       user_id,
    username:      username,
    user_email:    user_email,
    user_ip:       '1.2.3.4',
    user_fullname: 'John Doe',
    user_phone:    '+393331234567',
    lang:          'tr',        // page opening language (default: tr)
    currency:      'TRY',       // page opening currency (default: TRY)
});

const url = new URL('https://dodopin.com/checkout/token.php');

const req = https.request({
    hostname: url.hostname,
    path:     url.pathname,
    method:   'POST',
    headers:  {
        'Content-Type':   'application/x-www-form-urlencoded',
        'Content-Length': Buffer.byteLength(body),
    },
}, (res) => {
    let data = '';
    res.on('data', c => data += c);
    res.on('end',  () => {
        const json = JSON.parse(data);
        if (json.success) console.log('Redirect →', json.redirect);
        else throw new Error(json.message);
    });
});

req.on('error', err => { throw err; });
req.write(body);
req.end();

import requests, hmac, hashlib, base64

API_KEY    = 'YOUR_API_KEY'
API_SECRET = 'YOUR_API_SECRET'
store_id   = 12345
user_id    = 678
username   = 'username'
user_email = '[email protected]'

hash_string = API_KEY + '|' + str(store_id) + '|' + str(user_id) + '|' + username + '|' + user_email
hash_val = base64.b64encode(
    hmac.new(API_SECRET.encode(), hash_string.encode(), hashlib.sha256).digest()
).decode()

resp = requests.post(
    'https://dodopin.com/checkout/token.php',
    data={
        'api_key':       API_KEY,
        'hash':          hash_val,
        'store_id':      store_id,
        'user_id':       user_id,
        'username':      username,
        'user_email':    user_email,
        'user_ip':       '1.2.3.4',
        'user_fullname': 'John Doe',
        'user_phone':    '+201001234567',
        'lang':          'tr',        # page opening language (default: tr)
        'currency':      'TRY',       # page opening currency (default: TRY)
    },
    timeout=30,
)
resp.raise_for_status()
data = resp.json()

if data.get('success'):
    redirect_url = data['redirect']   # redirect user here
else:
    raise RuntimeError(data.get('message'))

# Compute hash first (shell)
HASH=$(printf '%s' 'YOUR_API_KEY|12345|678|username|[email protected]' \
  | openssl dgst -sha256 -hmac 'YOUR_API_SECRET' -binary | base64)

curl -X POST 'https://dodopin.com/checkout/token.php' \
  -d 'api_key=YOUR_API_KEY' \
  --data-urlencode "hash=$HASH" \
  -d 'store_id=12345' \
  -d 'user_id=678' \
  -d 'username=username' \
  -d '[email protected]' \
  -d 'user_ip=1.2.3.4' \
  -d 'user_fullname=John+Doe' \
  -d 'user_phone=%2B13125550100' \
  -d 'lang=tr' \
  -d 'currency=TRY'

const express = require('express');
const crypto  = require('crypto');

const app = express();
app.use(express.urlencoded({ extended: true }));

app.post('/webhook', (req, res) => {
    // Payload is a flat POST body — all fields at root level
    const {
        merchant_id  = '',
        order_ref    = '',
        user_fullname = '',
        invoice_mail = '',
        gateway_name = '',
        status       = '',
        hash         = '',
    } = req.body;

    const expected = Buffer.from(crypto
        .createHmac('sha256', process.env.API_SECRET)
        .update(merchant_id + order_ref + user_fullname + invoice_mail + gateway_name + status + process.env.API_KEY)
        .digest()
    ).toString('base64');

    const hBuf = Buffer.from(hash);
    const eBuf = Buffer.from(expected);
    if (hBuf.length !== eBuf.length || !crypto.timingSafeEqual(hBuf, eBuf))
        return res.status(403).send('invalid_hash');

    if (status === 'success') {
        const topup = parseFloat(req.body.total_topup_amount || '0');
        const user  = req.body.username || '';
        // Credit topup to the player's in-game balance
        // e.g. addBalance(user, topup);
    }

    res.type('text').send('OK');
});

app.listen(3000);

import hmac, hashlib, base64
from flask import Flask, request, abort

app = Flask(__name__)

@app.route('/webhook', methods=['POST'])
def webhook():
    # Payload is a flat POST body — all fields at root level
    f = lambda k: request.form.get(k, '')
    hash_string = (
        f('merchant_id')  +
        f('order_ref')    +
        f('user_fullname') +
        f('invoice_mail') +
        f('gateway_name') +
        f('status')       +
        API_KEY
    )
    expected = base64.b64encode(
        hmac.new(API_SECRET.encode(), hash_string.encode(), hashlib.sha256).digest()
    ).decode()

    if not hmac.compare_digest(f('hash'), expected):
        abort(403)

    if f('status') == 'success':
        topup = float(f('total_topup_amount') or '0')
        user  = f('username')
        # Credit topup to the player's in-game balance
        # e.g. add_balance(user, topup)

    return 'OK', 200, {'Content-Type': 'text/plain'}