Integracja Sablex: test, live i webhooks.

<?php
$apiKey = getenv('SABLEX_API_KEY');
$idempotencyKey = 'order-' . bin2hex(random_bytes(12));

$payload = [
    'serviceId' => 'instagram-followers-world-846',
    'link' => 'https://www.instagram.com/sablexpl/',
    'quantity' => 100,
    'externalOrderId' => 'shop-order-4519',
];

$curl = curl_init('https://sablex.pl/api/v1/orders');
curl_setopt_array($curl, [
    CURLOPT_POST => true,
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_TIMEOUT => 20,
    CURLOPT_HTTPHEADER => [
        'Authorization: Bearer ' . $apiKey,
        'Content-Type: application/json',
        'Idempotency-Key: ' . $idempotencyKey,
    ],
    CURLOPT_POSTFIELDS => json_encode($payload, JSON_THROW_ON_ERROR),
]);

$body = curl_exec($curl);
if ($body === false) throw new RuntimeException(curl_error($curl));
$status = curl_getinfo($curl, CURLINFO_RESPONSE_CODE);
curl_close($curl);
$result = json_decode($body, true, 512, JSON_THROW_ON_ERROR);
if ($status < 200 || $status >= 300) {
    throw new RuntimeException($result['error']['code'] . ': ' . $result['error']['message']);
}
print_r($result['data']);

import os
import secrets
import requests

response = requests.post(
    "https://sablex.pl/api/v1/orders",
    headers={
        "Authorization": f"Bearer {os.environ['SABLEX_API_KEY']}",
        "Content-Type": "application/json",
        "Idempotency-Key": f"order-{secrets.token_hex(12)}",
    },
    json={
        "serviceId": "instagram-followers-world-846",
        "link": "https://www.instagram.com/sablexpl/",
        "quantity": 100,
        "externalOrderId": "shop-order-4519",
    },
    timeout=20,
)

payload = response.json()
if not response.ok:
    error = payload.get("error", {})
    raise RuntimeError(f"{error.get('code')}: {error.get('message')}")
print(payload["data"])

import { randomUUID } from "node:crypto";

const response = await fetch("https://sablex.pl/api/v1/orders", {
  method: "POST",
  headers: {
    Authorization: `Bearer ${process.env.SABLEX_API_KEY}`,
    "Content-Type": "application/json",
    "Idempotency-Key": `order-${randomUUID()}`,
  },
  body: JSON.stringify({
    serviceId: "instagram-followers-world-846",
    link: "https://www.instagram.com/sablexpl/",
    quantity: 100,
    externalOrderId: "shop-order-4519",
  }),
  signal: AbortSignal.timeout(20_000),
});

const payload = await response.json();
if (!response.ok) {
  throw new Error(`${payload.error?.code}: ${payload.error?.message}`);
}
console.log(payload.data);

<?php
$secret = getenv('SABLEX_WEBHOOK_SECRET');
$rawBody = file_get_contents('php://input');
$timestamp = $_SERVER['HTTP_SABLEX_TIMESTAMP'] ?? '';
$header = $_SERVER['HTTP_SABLEX_SIGNATURE'] ?? '';
$provided = str_starts_with($header, 'v1=') ? substr($header, 3) : '';

if (!ctype_digit($timestamp) || abs(time() - (int) $timestamp) > 300) {
    http_response_code(400); exit('stale timestamp');
}
$expected = hash_hmac('sha256', $timestamp . '.' . $rawBody, $secret);
if (!$provided || !hash_equals($expected, $provided)) {
    http_response_code(401); exit('invalid signature');
}
$event = json_decode($rawBody, true, 512, JSON_THROW_ON_ERROR);
http_response_code(200); echo 'ok';

import hashlib
import hmac
import os
import time
from flask import Flask, request, abort

app = Flask(__name__)
secret = os.environ["SABLEX_WEBHOOK_SECRET"].encode()

@app.post("/webhooks/sablex")
def sablex_webhook():
    raw_body = request.get_data(cache=False)
    timestamp = request.headers.get("Sablex-Timestamp", "")
    signature = request.headers.get("Sablex-Signature", "")
    if not timestamp.isdigit() or abs(time.time() - int(timestamp)) > 300:
        abort(400)
    provided = signature[3:] if signature.startswith("v1=") else ""
    expected = hmac.new(
        secret, timestamp.encode() + b"." + raw_body, hashlib.sha256
    ).hexdigest()
    if not provided or not hmac.compare_digest(expected, provided):
        abort(401)
    event = request.get_json(force=True)
    return "ok", 200

import crypto from "node:crypto";
import express from "express";

const app = express();
app.post(
  "/webhooks/sablex",
  express.raw({ type: "application/json" }),
  (request, response) => {
    const timestamp = request.header("Sablex-Timestamp") || "";
    const signature = request.header("Sablex-Signature") || "";
    const provided = signature.startsWith("v1=") ? signature.slice(3) : "";
    if (!/^\d+$/.test(timestamp) || Math.abs(Date.now()/1000-Number(timestamp)) > 300) {
      return response.status(400).send("stale timestamp");
    }
    const expected = crypto.createHmac("sha256", process.env.SABLEX_WEBHOOK_SECRET)
      .update(`${timestamp}.`).update(request.body).digest("hex");
    const left = Buffer.from(expected, "hex");
    const right = Buffer.from(provided, "hex");
    if (left.length !== right.length || !crypto.timingSafeEqual(left, right)) {
      return response.status(401).send("invalid signature");
    }
    const event = JSON.parse(request.body.toString("utf8"));
    return response.status(200).send("ok");
  }
);