Generic Webhook Integration

For payment systems that aren't Stripe, Paddle, or Chargebee — bank transfers, WooCommerce, Square, Braintree, or any custom checkout — send conversion events directly from your server using a signed HTTP webhook.

How it works

When a customer completes a purchase on your site, your server sends a signed JSON payload to AFFY's webhook endpoint. AFFY verifies the signature, attributes the conversion to the correct affiliate, creates a commission, and makes the customer visible in your dashboard.

Setup

// Read the click ID from the cookie
function getAffyClickId() {
  const match = document.cookie.match(/(?:^|; )affy_click_id=([^;]*)/);
  return match ? match[1] : null;
}

// Pass to your checkout handler
const clickId = getAffyClickId();

Webhook endpoint

Replace {publicId} with your Public ID from Settings → Integration.

Request format

Signing requests

Compute an HMAC-SHA256 digest of the raw JSON body using your Webhook Secret, then send it in the X-Affy-Signature header as sha256=<hex>.

const crypto = require('crypto');

const WEBHOOK_SECRET = process.env.AFFY_WEBHOOK_SECRET;
const PUBLIC_ID      = process.env.AFFY_PUBLIC_ID;

async function sendConversion(order, clickId) {
  const body = JSON.stringify({
    transactionId:  order.id,
    amount:         order.total,
    currency:       order.currency,
    clickId,
    customerEmail:  order.customerEmail,
    customerName:   order.customerName,
    paymentMethod:  'BANK_TRANSFER',
  });

  const signature = 'sha256=' +
    crypto.createHmac('sha256', WEBHOOK_SECRET)
          .update(body)
          .digest('hex');

  const res = await fetch(`https://app.affy.pro/api/v1/webhooks/generic/${PUBLIC_ID}`, {
    method:  'POST',
    headers: { 'Content-Type': 'application/json', 'X-Affy-Signature': signature },
    body,
  });

  return res.json(); // { conversionId, status, message }
}

import hmac, hashlib, json, os, requests

WEBHOOK_SECRET = os.environ['AFFY_WEBHOOK_SECRET']
PUBLIC_ID      = os.environ['AFFY_PUBLIC_ID']

def send_conversion(order, click_id):
    body = json.dumps({
        'transactionId': order['id'],
        'amount':        order['total'],
        'currency':      order['currency'],
        'clickId':       click_id,
        'customerEmail': order['customer_email'],
        'paymentMethod': 'BANK_TRANSFER',
    }, separators=(',', ':'))

    sig = 'sha256=' + hmac.new(
        WEBHOOK_SECRET.encode(), body.encode(), hashlib.sha256
    ).hexdigest()

    r = requests.post(
        f'https://app.affy.pro/api/v1/webhooks/generic/{PUBLIC_ID}',
        data=body,
        headers={'Content-Type': 'application/json', 'X-Affy-Signature': sig},
    )
    return r.json()

<?php
$secret   = getenv('AFFY_WEBHOOK_SECRET');
$publicId = getenv('AFFY_PUBLIC_ID');

$body = json_encode([
    'transactionId' => $order['id'],
    'amount'        => $order['total'],
    'currency'      => $order['currency'],
    'clickId'       => $clickId,
    'customerEmail' => $order['email'],
    'paymentMethod' => 'BANK_TRANSFER',
]);

$sig = 'sha256=' . hash_hmac('sha256', $body, $secret);

$ch = curl_init("https://app.affy.pro/api/v1/webhooks/generic/{$publicId}");
curl_setopt_array($ch, [
    CURLOPT_POST           => true,
    CURLOPT_POSTFIELDS     => $body,
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER     => [
        'Content-Type: application/json',
        "X-Affy-Signature: {$sig}",
    ],
]);
$result = json_decode(curl_exec($ch), true);

require 'net/http'
require 'openssl'
require 'json'

secret    = ENV['AFFY_WEBHOOK_SECRET']
public_id = ENV['AFFY_PUBLIC_ID']

body = JSON.generate(
  transactionId: order[:id],
  amount:        order[:total],
  currency:      order[:currency],
  clickId:       click_id,
  customerEmail: order[:email],
  paymentMethod: 'BANK_TRANSFER'
)

sig = 'sha256=' + OpenSSL::HMAC.hexdigest('SHA256', secret, body)

uri = URI("https://app.affy.pro/api/v1/webhooks/generic/#{public_id}")
Net::HTTP.start(uri.host, uri.port, use_ssl: true) do |http|
  req = Net::HTTP::Post.new(uri, 'Content-Type' => 'application/json', 'X-Affy-Signature' => sig)
  req.body = body
  http.request(req)
end

Response

Rotating your secret

Go to Settings → Integration → Generic Webhook and click Rotate Secret. A new 64-character secret is generated immediately. Update your server's environment variable before rotating — any in-flight requests signed with the old secret will be rejected as soon as the rotation completes.