praxis-webhooks

Praxis Webhooks

Praxis (Praxis Tech, the "Cashier" payment orchestration platform) signs every outbound webhook with a SHA-384 hex digest in the lowercase gt-authentication header. This is not an HMAC and not Standard Webhooks: Praxis takes a fixed, per-webhook-type list of field values in the documented order, concatenates them into one string, appends your Merchant Secret, and hashes the result with sha384. Your endpoint must reply 200 with a { "status": 0, ... } body and sign that acknowledgement with the external-request-signature header.

When to Use This Skill

• How do I receive Praxis / Praxis Tech / Cashier webhooks?
• How do I verify the gt-authentication signature on a Praxis webhook?
• Why is my Praxis SHA-384 signature verification failing?
• How do I sign the Praxis acknowledgement (external-request-signature)?
• How do I handle Payment Notification transaction_status (pending, approved, rejected, error)?
• How do I handle a Praxis Subscription Notification event?

Verification (core)

Concatenate the documented field values in order (do not alphabetize — that is only for the general API-request signature), append the Merchant Secret, then sha384 (hex). Compare to the gt-authentication header.

const crypto = require('crypto');

const PAYMENT_FIELDS = ['merchant_id', 'application_key', 'timestamp', 'customer.customer_token',
  'session.order_id', 'transaction.tid', 'transaction.currency', 'transaction.amount',
  'transaction.conversion_rate', 'transaction.processed_currency', 'transaction.processed_amount'];
const SUBSCRIPTION_FIELDS = ['event', 'merchant_id', 'application_key', 'cid', 'plan_id',
  'subscription_id', 'subscription_status', 'timestamp'];

const at = (o, p) => p.split('.').reduce((x, k) => (x == null ? undefined : x[k]), o);

// Subscription Notifications carry an `event` field; Payment Notifications do not.
function verifyPraxis(body, headerSig, merchantSecret) {
  const fields = body.event ? SUBSCRIPTION_FIELDS : PAYMENT_FIELDS;
  const data = fields.map((p) => String(at(body, p) ?? '')).join('') + merchantSecret;
  const expected = crypto.createHash('sha384').update(data, 'utf8').digest('hex');
  const a = Buffer.from(String(headerSig || ''), 'utf8');
  const b = Buffer.from(expected, 'utf8');
  return a.length === b.length && crypto.timingSafeEqual(a, b); // timing-safe
}