// Append redirect_success_url before sending user to payment page
const paymentUrl = response.payment_page_url + "&redirect_success_url=https://yoursite.com/payment/success";
// Then redirect user:
window.location.href = paymentUrl;

import hashlib
from urllib.parse import urlencode
from flask import Flask, request, jsonify

app = Flask(__name__)
CLIENT_POSTBACK_KEY = "your_client_postback_key"

def verify_signature(payload, key):
    received_sign = payload.get("sign")
    if not received_sign:
        return False
    data = {k: v for k, v in payload.items() if k != "sign"}
    data["client_postback_key"] = key
    # IMPORTANT: Sort keys alphabetically
    expected_sign = hashlib.md5(
        urlencode(sorted(data.items())).encode("utf-8")
    ).hexdigest()
    return expected_sign == received_sign

@app.route("/webhook/transactions", methods=["POST"])
def handle_webhook():
    payload = request.get_json()
    if not verify_signature(payload, CLIENT_POSTBACK_KEY):
        return jsonify({"status": 500, "message": "Invalid signature"}), 500
    # Process transaction...
    for txn in payload.get("transactions", []):
        txn_id = txn["transaction_id"]
        amount = txn["transaction_amount"]
        print(f"Transaction {txn_id}: {amount}")
    return jsonify({"status": 200, "message": "OK"}), 200

const express = require("express");
const crypto = require("crypto");

const app = express();
// Preserve raw body for accurate float detection
app.use(express.json({
  verify: (req, res, buf) => { req.rawBody = buf.toString("utf-8"); }
}));
const CLIENT_POSTBACK_KEY = "your_client_postback_key";

// Match Python's quote_plus encoding (differs from encodeURIComponent)
function quotePlus(s) {
  return encodeURIComponent(String(s))
    .replace(/%20/g, "+")
    .replace(/'/g, "%27")
    .replace(/!/g, "%21")
    .replace(/\*/g, "%2A")
    .replace(/\(/g, "%28")
    .replace(/\)/g, "%29");
}

// Detect numeric fields that had decimal points in the raw JSON
// (JavaScript's JSON.parse loses float vs int distinction: 5000.0 -> 5000)
function detectFloatKeys(rawJson) {
  const floatKeys = new Set();
  const regex = /"(\w+)"\s*:\s*-?\d+\.\d+/g;
  let m;
  while ((m = regex.exec(rawJson)) !== null) {
    floatKeys.add(m[1]);
  }
  return floatKeys;
}

// Convert a JS value to Python repr() style (with quotes for strings)
function pythonRepr(value, floatKeys, key) {
  if (value === null || value === undefined) return "None";
  if (value === true) return "True";
  if (value === false) return "False";
  if (typeof value === "number") {
    if (Number.isInteger(value) && floatKeys && floatKeys.has(key))
      return value + ".0";
    return String(value);
  }
  if (typeof value === "string") return "\'" + value + "\'";
  if (Array.isArray(value)) {
    return "[" + value.map(v => pythonRepr(v, floatKeys, null)).join(", ") + "]";
  }
  if (typeof value === "object") {
    const items = Object.entries(value)
      .map(([k, v]) => "\'" + k + "\': " + pythonRepr(v, floatKeys, k));
    return "{" + items.join(", ") + "}";
  }
  return String(value);
}

// Convert a JS value to Python str() (no quotes for strings)
function pythonStr(value, floatKeys, key) {
  if (typeof value === "string") return value;
  return pythonRepr(value, floatKeys, key);
}

function verifySignature(payload, rawBody, key) {
  const receivedSign = payload.sign;
  if (!receivedSign) return false;
  const floatKeys = detectFloatKeys(rawBody);
  const data = { ...payload };
  delete data.sign;
  data.client_postback_key = key;
  // Sort keys alphabetically, build URL-encoded string
  const sortedKeys = Object.keys(data).sort();
  const parts = sortedKeys.map(k =>
    quotePlus(k) + "=" + quotePlus(pythonStr(data[k], floatKeys, k))
  );
  const str2hash = parts.join("&");
  const expectedSign = crypto
    .createHash("md5")
    .update(str2hash)
    .digest("hex");
  return expectedSign === receivedSign;
}

app.post("/webhook/transactions", (req, res) => {
  const payload = req.body;
  if (!verifySignature(payload, req.rawBody, CLIENT_POSTBACK_KEY)) {
    return res.status(500).json({
      status: 500, message: "Invalid signature"
    });
  }
  // Process transactions...
  payload.transactions.forEach(txn => {
    console.log(txn.transaction_id, txn.transaction_amount);
  });
  return res.status(200).json({ status: 200, message: "OK" });
});

app.listen(5000);

<?php
$client_postback_key = "your_client_postback_key";
$payload = json_decode(file_get_contents("php://input"), true);

$received_sign = $payload["sign"];
unset($payload["sign"]);
$payload["client_postback_key"] = $client_postback_key;

// Convert PHP value to Python repr (with quotes for strings)
function python_repr($value) {
    if (is_null($value)) return "None";
    if (is_bool($value)) return $value ? "True" : "False";
    if (is_int($value)) return (string)$value;
    if (is_float($value)) {
        $s = (string)$value;
        if (strpos($s, ".") === false && strpos($s, "E") === false) $s .= ".0";
        return $s;
    }
    if (is_string($value)) return "\'" . $value . "\'";
    if (is_array($value)) {
        if (array_values($value) === $value) {
            // Sequential array -> Python list
            $items = array_map("python_repr", $value);
            return "[" . implode(", ", $items) . "]";
        } else {
            // Associative array -> Python dict
            $items = [];
            foreach ($value as $k => $v) {
                $items[] = "\'" . $k . "\': " . python_repr($v);
            }
            return "{" . implode(", ", $items) . "}";
        }
    }
    return (string)$value;
}

// Convert PHP value to Python str (no quotes for strings)
function python_str($value) {
    if (is_string($value)) return $value;
    return python_repr($value);
}

// Sort keys alphabetically, URL-encode matching Python urlencode
ksort($payload);
$parts = [];
foreach ($payload as $key => $value) {
    $parts[] = urlencode((string)$key) . "=" . urlencode(python_str($value));
}
$str2hash = implode("&", $parts);
$expected_sign = md5($str2hash);

if ($expected_sign === $received_sign) {
    foreach ($payload["transactions"] as $txn) {
        // Process each transaction
    }
    http_response_code(200);
    echo json_encode(["status" => 200, "message" => "OK"]);
} else {
    http_response_code(500);
    echo json_encode(["status" => 500, "message" => "Invalid signature"]);
}
?>

import hashlib
from urllib.parse import urlencode
from flask import Flask, request, jsonify

app = Flask(__name__)
WITHDRAWAL_POSTBACK_KEY = "your_withdrawal_postback_key"

def verify_signature(payload, key):
    received_sign = payload.get("sign")
    if not received_sign:
        return False
    data = {k: v for k, v in payload.items() if k != "sign"}
    data["withdrawal_postback_key"] = key
    expected_sign = hashlib.md5(
        urlencode(data).encode("utf-8")
    ).hexdigest()
    return expected_sign == received_sign

@app.route("/webhook/payouts", methods=["POST"])
def handle_webhook():
    payload = request.get_json()
    if not verify_signature(payload, WITHDRAWAL_POSTBACK_KEY):
        return jsonify({"status": 500, "message": "Invalid signature"}), 500
    # Process withdrawal...
    withdrawal_id = payload["withdrawal_id"]
    status = payload["status"]  # "success" or "failed"
    return jsonify({"status": 200, "message": "OK"}), 200

const express = require("express");
const crypto = require("crypto");

const app = express();
// Preserve raw body for accurate float detection
app.use(express.json({
  verify: (req, res, buf) => { req.rawBody = buf.toString("utf-8"); }
}));
const WITHDRAWAL_POSTBACK_KEY = "your_withdrawal_postback_key";

// Match Python's quote_plus encoding (differs from encodeURIComponent)
function quotePlus(s) {
  return encodeURIComponent(String(s))
    .replace(/%20/g, "+")
    .replace(/'/g, "%27")
    .replace(/!/g, "%21")
    .replace(/\*/g, "%2A")
    .replace(/\(/g, "%28")
    .replace(/\)/g, "%29");
}

// Detect numeric fields that had decimal points in the raw JSON
function detectFloatKeys(rawJson) {
  const floatKeys = new Set();
  const regex = /"(\w+)"\s*:\s*-?\d+\.\d+/g;
  let m;
  while ((m = regex.exec(rawJson)) !== null) {
    floatKeys.add(m[1]);
  }
  return floatKeys;
}

function pythonRepr(value, floatKeys, key) {
  if (value === null || value === undefined) return "None";
  if (value === true) return "True";
  if (value === false) return "False";
  if (typeof value === "number") {
    if (Number.isInteger(value) && floatKeys && floatKeys.has(key))
      return value + ".0";
    return String(value);
  }
  if (typeof value === "string") return "\'" + value + "\'";
  if (Array.isArray(value)) {
    return "[" + value.map(v => pythonRepr(v, floatKeys, null)).join(", ") + "]";
  }
  if (typeof value === "object") {
    const items = Object.entries(value)
      .map(([k, v]) => "\'" + k + "\': " + pythonRepr(v, floatKeys, k));
    return "{" + items.join(", ") + "}";
  }
  return String(value);
}

function pythonStr(value, floatKeys, key) {
  if (typeof value === "string") return value;
  return pythonRepr(value, floatKeys, key);
}

function verifySignature(payload, rawBody, key) {
  const receivedSign = payload.sign;
  if (!receivedSign) return false;
  const floatKeys = detectFloatKeys(rawBody);
  const data = { ...payload };
  delete data.sign;
  data.withdrawal_postback_key = key;
  // URL-encode key-value pairs (do NOT sort keys)
  const parts = Object.entries(data).map(([k, v]) =>
    quotePlus(k) + "=" + quotePlus(pythonStr(v, floatKeys, k))
  );
  const str2hash = parts.join("&");
  const expectedSign = crypto
    .createHash("md5")
    .update(str2hash)
    .digest("hex");
  return expectedSign === receivedSign;
}

app.post("/webhook/payouts", (req, res) => {
  const payload = req.body;
  if (!verifySignature(payload, req.rawBody, WITHDRAWAL_POSTBACK_KEY)) {
    return res.status(500).json({
      status: 500, message: "Invalid signature"
    });
  }
  // Process withdrawal...
  console.log(payload.withdrawal_id, payload.status);
  return res.status(200).json({ status: 200, message: "OK" });
});

app.listen(5000);

<?php
$withdrawal_postback_key = "your_withdrawal_postback_key";
$payload = json_decode(file_get_contents("php://input"), true);

$received_sign = $payload["sign"];
unset($payload["sign"]);
$payload["withdrawal_postback_key"] = $withdrawal_postback_key;

// Convert PHP value to Python repr (with quotes for strings)
function python_repr($value) {
    if (is_null($value)) return "None";
    if (is_bool($value)) return $value ? "True" : "False";
    if (is_int($value)) return (string)$value;
    if (is_float($value)) {
        $s = (string)$value;
        if (strpos($s, ".") === false && strpos($s, "E") === false) $s .= ".0";
        return $s;
    }
    if (is_string($value)) return "\'" . $value . "\'";
    if (is_array($value)) {
        if (array_values($value) === $value) {
            $items = array_map("python_repr", $value);
            return "[" . implode(", ", $items) . "]";
        } else {
            $items = [];
            foreach ($value as $k => $v) {
                $items[] = "\'" . $k . "\': " . python_repr($v);
            }
            return "{" . implode(", ", $items) . "}";
        }
    }
    return (string)$value;
}

function python_str($value) {
    if (is_string($value)) return $value;
    return python_repr($value);
}

// URL-encode key-value pairs (do NOT sort keys)
$parts = [];
foreach ($payload as $key => $value) {
    $parts[] = urlencode((string)$key) . "=" . urlencode(python_str($value));
}
$str2hash = implode("&", $parts);
$expected_sign = md5($str2hash);

if ($expected_sign === $received_sign) {
    http_response_code(200);
    echo json_encode(["status" => 200, "message" => "OK"]);
} else {
    http_response_code(500);
    echo json_encode(["status" => 500, "message" => "Invalid signature"]);
}
?>