Example Webhook Payload:

{
  "_id": "68ff7ebd5ca87b974785edba",
  "orderId": "R17615745886108X8UO",
  "status": "success",
  "items": [
    {
      "name": "Shopping list",
      "quantity": 1,
      "unitPrice": {
        "$numberDecimal": "198500"
      }
    }
  ],
  "total": {
    "$numberDecimal": "198500"
  },
  "user": {
    "_id": "68fccd6de44a",
    "email": "user@email.ng",
    "firstName": "John",
    "lastName": "Doe",
    "phone": "090987654321"
  },
  "createdAt": "2025-10-27T14:16:29.833Z",
  "updatedAt": "2025-10-27T18:23:36.021Z",
}

Example Implementation:

// Example: Confirm order fulfillment after processing
async function confirmOrderFulfillment(orderId, email, apiKey apiSecret) {
  try {
    const response = await fetch('https://migoapi.agiletech.ng/api/order/fulfilment', {
      method: 'POST',
      headers: {
        'Content-Type': 'application/json',
        'x-api-key': apiKey  // API key from your dashboard
        'x-api-secret': apiSecret  // API key from your dashboard
      },
      body: JSON.stringify({
        orderId: orderId,
        email: email
      })
    });

    if (response.ok) {
      console.log('Order fulfillment confirmed with Migo');
      return true;
    } else {
      console.error('Failed to confirm fulfillment:', await response.text());
      return false;
    }
  } catch (error) {
    console.error('Error confirming fulfillment:', error);
    return false;
  }
}

// Call after showing order confirmation to customer
const API_KEY = 'your-api-key-from-dashboard';
confirmOrderFulfillment('TK11203030302', 'customer@example.com', API_KEY);

Example: Generating Signature (Node.js)

 const crypto = require('crypto');

  function generateWebhookSignature(merchantCode, webhookPayload) {
    // Step 1 & 2: Stringify the webhook payload
    const payloadString = JSON.stringify(webhookPayload);

    // Step 3: Generate HMAC-SHA256 signature
    const signature = crypto
      .createHmac('sha256', merchantCode)
      .update(payloadString)
      .digest('hex');

    return signature;
  }

  // Example: How Migo generates the signature
  const merchantCode = 'your-merchant-code';
  const webhookPayload = {
    orderId: 'ORD-123456',
    status: 'success',
    total: 18975,
    // ... other order data
  };

  const signature = generateWebhookSignature(merchantCode, webhookPayload);
  console.log('Generated Signature:', signature);
  // This signature is sent in the x-webhook-signature header

Example: Validating Webhook (Node.js/Express)

const crypto = require('crypto');
  const express = require('express');
  const app = express();

  app.post('/webhook/migo', express.raw({ type: 'application/json' }), (req, res) => {
    try {
      // Step 1: Retrieve signature from headers
      const receivedSignature = req.headers['x-webhook-signature'];

      if (!receivedSignature) {
        return res.status(401).json({ error: 'Missing signature' });
      }

      // Step 2: Generate local signature using HMAC-SHA256
      const merchantCode = process.env.MIGO_MERCHANT_CODE;

      // IMPORTANT: Use raw body buffer, not parsed JSON
      const rawBody = req.body.toString('utf8');

      const localSignature = crypto
        .createHmac('sha256', merchantCode)
        .update(rawBody)
        .digest('hex');

      // Step 3: Compare signatures (use timing-safe comparison)
      if (!crypto.timingSafeEqual(Buffer.from(localSignature), Buffer.from(receivedSignature))) {
        console.error('Invalid signature');
        return res.status(401).json({ error: 'Invalid signature' });
      }

      // Step 4: Signature is valid - parse and process webhook
      const payload = JSON.parse(rawBody);
      console.log('Valid webhook received:', payload);

      // Process the order fulfillment
      // ... your order processing logic here

      // Return success
      res.status(200).json({ success: true });

    } catch (error) {
      console.error('Webhook processing error:', error);
      res.status(500).json({ error: 'Internal server error' });
    }
  });