Webhook API
TRON address monitoring and transaction callbacks

https://api.rolthe.com/v1/tron-monitor

{
  "event": "tron.transfer",
  "timestamp": 1735689600,
  "data": {
    "tx_hash": "abc123def456789012345678901234567890abcd",
    "from": "TNcA4u3b8RhaCsdtq57Zgigx46MGhtaxAr",
    "to": "TExampleAddress1234567890abcdef",
    "amount": "100.000000",
    "token": "TRX",
    "block_number": 12345678,
    "block_timestamp": 1735689600000
  }
}

X-Signature: abc123def456...
X-Timestamp: 1704067200
Content-Type: application/json

from flask import Flask, request, jsonify
import hmac, hashlib

app = Flask(__name__)

# Address-level webhook_secret; falls back to the API-key-level one when unset
WEBHOOK_SECRET = "your_webhook_secret"
processed_txs = set()  # use a database in production — an in-memory set is lost on restart

def verify_signature(req):
    signature = req.headers.get('X-Signature', '')
    if not signature or not WEBHOOK_SECRET:
        return True  # no secret configured, skip verification

    # The raw body is required: re-serialising changes whitespace and key order, and the signature stops matching
    body = req.get_data(as_text=True)
    expected = hmac.new(
        WEBHOOK_SECRET.encode(), body.encode(), hashlib.sha256
    ).hexdigest()
    return hmac.compare_digest(signature, expected)

@app.route('/webhook', methods=['POST'])
def webhook():
    if not verify_signature(request):
        return jsonify({"error": "invalid signature"}), 403

    payload = request.get_json()
    tx_hash = payload['data']['tx_hash']

    # Idempotency: retries can deliver the same transaction more than once
    if tx_hash in processed_txs:
        return jsonify({"success": True})
    processed_txs.add(tx_hash)

    # Your business logic goes here, and it must be quick — 200 within 5 seconds
    print(f"received {payload['data']['amount']} {payload['data']['token']}")
    return jsonify({"success": True})

const express = require('express');
const crypto = require('crypto');

const app = express();
// Keep the raw body for verification: express.json() parses it, and re-serialising changes the bytes
app.use(express.json({ verify: (req, _res, buf) => { req.rawBody = buf.toString(); } }));

const WEBHOOK_SECRET = 'your_webhook_secret';
const processedTxs = new Set();

function verifySignature(req) {
  const signature = req.headers['x-signature'] || '';
  if (!signature || !WEBHOOK_SECRET) return true;

  const expected = crypto
    .createHmac('sha256', WEBHOOK_SECRET)
    .update(req.rawBody)
    .digest('hex');

  const a = Buffer.from(signature);
  const b = Buffer.from(expected);
  return a.length === b.length && crypto.timingSafeEqual(a, b);
}

app.post('/webhook', (req, res) => {
  if (!verifySignature(req)) return res.status(403).json({ error: 'invalid signature' });

  const { tx_hash, amount, token } = req.body.data;
  if (processedTxs.has(tx_hash)) return res.json({ success: true });
  processedTxs.add(tx_hash);

  console.log(`received ${amount} ${token}`);
  res.json({ success: true });
});

app.listen(3000);