📖 API Documentation

{
  "status": "success",
  "data": [
    [
      {
        "bankaccount": "xxx-x-x8685-x",
        "amount": "1.00",
        "currency": "บาท",
        "date": "2025-04-25 23:44:00",
        "balance": "239.50",
        "type": "เงินเข้า"
      }
    ],
    [
      {
        "bankaccount": "xxx-x-x8685-x",
        "amount": "800.00",
        "currency": "บาท",
        "date": "2025-04-24 22:06:00",
        "balance": "895.50",
        "type": "เงินเข้า"
      }
    ]
  ]
}

{
  "data": {
    "source": "line",
    "amount": "30.00",
    "bankaccount": "X-1964",
    "currency": "บาท",
    "date": "2026-08-05 20:26",
    "balance": "907460.23",
    "trans_id": "625966477152879227",
    "transactiontype": "เงินเข้า"
  },
  "signature": "d97e11486295aabd303a72ecf48b36b2438a1567ba47d18b6f457227fe78d2bc"
}

{"source":"line","amount":"30.00","bankaccount":"X-1964","currency":"\u0e1a\u0e32\u0e17","date":"2026-08-05 20:26","balance":"907460.23","trans_id":"625966477152879227","transactiontype":"\u0e40\u0e07\u0e34\u0e19\u0e40\u0e02\u0e49\u0e32"}

const crypto = require('crypto');

// สำคัญ: ต้องรับเป็น raw body ไม่ใช่ object ที่ parse แล้ว
app.use('/webhook', express.raw({ type: 'application/json' }));

app.post('/webhook', (req, res) => {
  const raw  = req.body.toString('utf8');
  const body = JSON.parse(raw);

  // ตัดเฉพาะส่วน data ออกจาก raw string (ไม่ re-serialize)
  const start = raw.indexOf('"data":') + 7;
  const end   = raw.lastIndexOf(',"signature"');
  const dataJson = raw.slice(start, end);

  const expected = crypto
    .createHmac('sha256', YOUR_API_KEY)
    .update(dataJson, 'utf8')
    .digest('hex');

  if (expected !== body.signature) {
    return res.status(401).json({ status: 0 });
  }

  // ผ่านการตรวจสอบ — ประมวลผลเงินเข้าได้
  res.json({ status: 1 });   // ต้องตอบ status:1 ไม่งั้นระบบนับว่าล้มเหลว
});

import hmac, hashlib, json
from flask import request, jsonify

@app.route('/webhook', methods=['POST'])
def webhook():
    raw  = request.get_data(as_text=True)
    body = json.loads(raw)

    start = raw.index('"data":') + 7
    end   = raw.rindex(',"signature"')
    data_json = raw[start:end]

    expected = hmac.new(
        YOUR_API_KEY.encode(),
        data_json.encode('utf-8'),
        hashlib.sha256
    ).hexdigest()

    if not hmac.compare_digest(expected, body['signature']):
        return jsonify(status=0), 401

    return jsonify(status=1)

<?php
$body = json_decode(file_get_contents('php://input'), true);
$expected = hash_hmac('sha256', json_encode($body['data']), $YOUR_API_KEY);

if (!hash_equals($expected, $body['signature'])) {
    http_response_code(401);
    exit(json_encode(['status' => 0]));
}

// ผ่านการตรวจสอบ
echo json_encode(['status' => 1]);

{
  "status": 1
}