Документация API

API_KEY="kh_…"   # id ключа
SECRET="sk_…"    # секрет ключа, показан один раз при создании
BASE="https://packetuphub.com"

METHOD="POST"
URI="/v1/orders"  # путь с query-строкой, без хоста
BODY='{"sku":"pubg-660","quantity":1,"uid":"5123456789"}'  # для GET — пустая строка
IDEM="shop-58213"  # ваш номер заказа; для GET — пустая строка

TS=$(date +%s)
HASH=$(printf '%s' "$BODY" | openssl dgst -sha256 | awk '{print $NF}')
TO_SIGN=$(printf '%s\n%s\n%s\n%s' "$TS" "$METHOD" "$URI" "$HASH")
[ -n "$IDEM" ] && TO_SIGN=$(printf '%s\n%s' "$TO_SIGN" "$IDEM")
SIG=$(printf '%s' "$TO_SIGN" | openssl dgst -sha256 -hmac "$SECRET" | awk '{print $NF}')

# для GET уберите Idempotency-Key, Content-Type и --data-raw
curl -sS -X "$METHOD" "$BASE$URI" \
  -H "X-Api-Key: $API_KEY" \
  -H "X-Timestamp: $TS" \
  -H "X-Signature: $SIG" \
  -H "Idempotency-Key: $IDEM" \
  -H "Content-Type: application/json" \
  --data-raw "$BODY"

import hashlib
import hmac
import json
import time

import requests  # pip install requests

API_KEY = "kh_…"
SECRET = "sk_…"
BASE = "https://packetuphub.com"


def call(method, uri, body=None, idempotency_key=None):
    raw = b"" if body is None else json.dumps(body, separators=(",", ":")).encode()
    ts = str(int(time.time()))
    to_sign = f"{ts}\n{method}\n{uri}\n{hashlib.sha256(raw).hexdigest()}"
    if idempotency_key:
        to_sign += f"\n{idempotency_key}"
    sig = hmac.new(SECRET.encode(), to_sign.encode(), hashlib.sha256).hexdigest()
    h = {"X-Api-Key": API_KEY, "X-Timestamp": ts, "X-Signature": sig}
    if raw:
        h["Content-Type"] = "application/json"
    if idempotency_key:
        h["Idempotency-Key"] = idempotency_key
    r = requests.request(method, BASE + uri, data=raw, headers=h, timeout=30)
    return r.status_code, (r.json() if r.content else None)


print(call("GET", "/v1/balance"))
print(call("POST", "/v1/orders",
           {"sku": "pubg-660", "quantity": 1, "uid": "5123456789"},
           "shop-58213"))

// Node.js 18+, файл .mjs: fetch и crypto встроены
import crypto from "node:crypto";

const API_KEY = "kh_…";
const SECRET = "sk_…";
const BASE = "https://packetuphub.com";

async function call(method, uri, body, idempotencyKey) {
  const raw = body === undefined ? "" : JSON.stringify(body);
  const ts = String(Math.floor(Date.now() / 1000));
  const hash = crypto.createHash("sha256").update(raw).digest("hex");
  let toSign = ts + "\n" + method + "\n" + uri + "\n" + hash;
  if (idempotencyKey) toSign += "\n" + idempotencyKey;
  const sig = crypto.createHmac("sha256", SECRET).update(toSign).digest("hex");
  const res = await fetch(BASE + uri, {
    method,
    headers: {
      "X-Api-Key": API_KEY,
      "X-Timestamp": ts,
      "X-Signature": sig,
      ...(raw ? { "Content-Type": "application/json" } : {}),
      ...(idempotencyKey ? { "Idempotency-Key": idempotencyKey } : {}),
    },
    body: raw || undefined,
  });
  const text = await res.text();
  return [res.status, text ? JSON.parse(text) : null];
}

console.log(await call("GET", "/v1/balance"));
console.log(await call("POST", "/v1/orders",
  { sku: "pubg-660", quantity: 1, uid: "5123456789" },
  "shop-58213"));

package main

import (
	"bytes"
	"crypto/hmac"
	"crypto/sha256"
	"encoding/hex"
	"encoding/json"
	"fmt"
	"io"
	"net/http"
	"strconv"
	"time"
)

const (
	apiKey = "kh_…"
	secret = "sk_…"
	base   = "https://packetuphub.com"
)

// call signs and sends a request; body is nil and idempotencyKey empty for GET.
func call(method, uri string, body []byte, idempotencyKey string) (int, []byte, error) {
	ts := strconv.FormatInt(time.Now().Unix(), 10)
	mac := hmac.New(sha256.New, []byte(secret))
	fmt.Fprintf(mac, "%s\n%s\n%s\n%x", ts, method, uri, sha256.Sum256(body))
	if idempotencyKey != "" {
		fmt.Fprintf(mac, "\n%s", idempotencyKey)
	}

	req, err := http.NewRequest(method, base+uri, bytes.NewReader(body))
	if err != nil {
		return 0, nil, err
	}
	req.Header.Set("X-Api-Key", apiKey)
	req.Header.Set("X-Timestamp", ts)
	req.Header.Set("X-Signature", hex.EncodeToString(mac.Sum(nil)))
	if len(body) > 0 {
		req.Header.Set("Content-Type", "application/json")
	}
	if idempotencyKey != "" {
		req.Header.Set("Idempotency-Key", idempotencyKey)
	}
	resp, err := http.DefaultClient.Do(req)
	if err != nil {
		return 0, nil, err
	}
	defer resp.Body.Close()
	out, err := io.ReadAll(resp.Body)
	return resp.StatusCode, out, err
}

func main() {
	body, _ := json.Marshal(map[string]any{"sku": "pubg-660", "quantity": 1, "uid": "5123456789"})
	status, out, err := call(http.MethodPost, "/v1/orders", body, "shop-58213")
	if err != nil {
		panic(err)
	}
	fmt.Println(status, string(out))
}

<?php
const API_KEY = 'kh_…';
const SECRET = 'sk_…';
const BASE = 'https://packetuphub.com';

function call(string $method, string $uri, ?array $body = null, string $idempotencyKey = ''): array
{
    $raw = $body === null ? '' : json_encode($body, JSON_UNESCAPED_SLASHES | JSON_UNESCAPED_UNICODE);
    $ts = (string) time();
    $lines = [$ts, $method, $uri, hash('sha256', $raw)];
    if ($idempotencyKey !== '') {
        $lines[] = $idempotencyKey;
    }
    $sig = hash_hmac('sha256', implode("\n", $lines), SECRET);
    $h = ['X-Api-Key: ' . API_KEY, 'X-Timestamp: ' . $ts, 'X-Signature: ' . $sig];
    if ($raw !== '') {
        $h[] = 'Content-Type: application/json';
    }
    if ($idempotencyKey !== '') {
        $h[] = 'Idempotency-Key: ' . $idempotencyKey;
    }
    $ch = curl_init(BASE . $uri);
    curl_setopt_array($ch, [
        CURLOPT_CUSTOMREQUEST => $method,
        CURLOPT_HTTPHEADER => $h,
        CURLOPT_RETURNTRANSFER => true,
    ]);
    if ($raw !== '') {
        curl_setopt($ch, CURLOPT_POSTFIELDS, $raw);
    }
    $res = curl_exec($ch);
    return [curl_getinfo($ch, CURLINFO_RESPONSE_CODE), $res ? json_decode($res, true) : null];
}

var_dump(call('GET', '/v1/balance'));
var_dump(call('POST', '/v1/orders',
    ['sku' => 'pubg-660', 'quantity' => 1, 'uid' => '5123456789'],
    'shop-58213'));

POST /packetuphub/webhook HTTP/1.1
Content-Type: application/json
X-Webhook-Id: 019a2b3c-4d5e-7f60-8a9b-0c1d2e3f4a5b
X-Webhook-Event: order.completed
X-Webhook-Timestamp: 1793088042
X-Webhook-Signature: 5d0c…9a1e

{
  "id": "019a2b3c-4d5e-7f60-8a9b-0c1d2e3f4a5b",
  "type": "order.completed",
  "created_at": "2026-10-28T12:00:42Z",
  "data": {
    "order_id": "0f8a5c2e-9b1d-4e7a-a3f6-5d2c8e1b7a40",
    "number": 10482,
    "reference": "shop-58213",
    "status": "completed"
  }
}

import hashlib
import hmac
import time

from flask import Flask, abort, request

WEBHOOK_SECRET = b"whsec_…"
app = Flask(__name__)


@app.post("/packetuphub/webhook")
def webhook():
    ts = request.headers.get("X-Webhook-Timestamp", "")
    raw = request.get_data()  # байты тела ровно как пришли
    if not ts.isdigit() or abs(time.time() - int(ts)) > 300:
        abort(400)
    want = hmac.new(WEBHOOK_SECRET, ts.encode() + b"\n" + raw, hashlib.sha256).hexdigest()
    sigs = request.headers.get("X-Webhook-Signature", "").split(",")
    if not any(hmac.compare_digest(want, s) for s in sigs):
        abort(401)
    event = request.get_json()
    # если event["id"] уже обработан — просто ответьте 2xx; иначе поставьте в очередь
    return "", 204

import crypto from "node:crypto";
import express from "express";

const WEBHOOK_SECRET = "whsec_…";
const app = express();

// raw: подпись считается от байтов тела ровно как они пришли
app.post("/packetuphub/webhook", express.raw({ type: "application/json" }), (req, res) => {
  const ts = req.get("X-Webhook-Timestamp") || "";
  if (!/^\d+$/.test(ts) || Math.abs(Date.now() / 1000 - Number(ts)) > 300) {
    return res.sendStatus(400);
  }
  const want = crypto.createHmac("sha256", WEBHOOK_SECRET)
    .update(ts + "\n").update(req.body).digest("hex");
  const ok = (req.get("X-Webhook-Signature") || "").split(",").some((s) =>
    s.length === want.length && crypto.timingSafeEqual(Buffer.from(s), Buffer.from(want)));
  if (!ok) {
    return res.sendStatus(401);
  }
  const event = JSON.parse(req.body);
  // если event.id уже обработан — просто ответьте 2xx; иначе поставьте в очередь
  res.sendStatus(204);
});

app.listen(8080);

const webhookSecret = "whsec_…"

func webhook(w http.ResponseWriter, r *http.Request) {
	body, err := io.ReadAll(io.LimitReader(r.Body, 1<<20)) // байты тела ровно как пришли
	if err != nil {
		http.Error(w, "read body", http.StatusBadRequest)
		return
	}
	ts := r.Header.Get("X-Webhook-Timestamp")
	sec, err := strconv.ParseInt(ts, 10, 64)
	if err != nil || time.Since(time.Unix(sec, 0)).Abs() > 5*time.Minute {
		http.Error(w, "stale timestamp", http.StatusBadRequest)
		return
	}
	mac := hmac.New(sha256.New, []byte(webhookSecret))
	mac.Write([]byte(ts + "\n"))
	mac.Write(body)
	want := hex.EncodeToString(mac.Sum(nil))

	ok := false
	for _, sig := range strings.Split(r.Header.Get("X-Webhook-Signature"), ",") {
		ok = ok || hmac.Equal([]byte(sig), []byte(want))
	}
	if !ok {
		http.Error(w, "bad signature", http.StatusUnauthorized)
		return
	}
	var event struct {
		ID   string          `json:"id"`
		Type string          `json:"type"`
		Data json.RawMessage `json:"data"`
	}
	if err := json.Unmarshal(body, &event); err != nil {
		http.Error(w, "bad json", http.StatusBadRequest)
		return
	}
	// если event.ID уже обработан — просто ответьте 2xx; иначе поставьте в очередь
	w.WriteHeader(http.StatusNoContent)
}

<?php
const WEBHOOK_SECRET = 'whsec_…';

$raw = file_get_contents('php://input'); // байты тела ровно как пришли
$ts = $_SERVER['HTTP_X_WEBHOOK_TIMESTAMP'] ?? '';
if (!ctype_digit($ts) || abs(time() - (int) $ts) > 300) {
    http_response_code(400);
    exit;
}
$want = hash_hmac('sha256', $ts . "\n" . $raw, WEBHOOK_SECRET);
$ok = false;
foreach (explode(',', $_SERVER['HTTP_X_WEBHOOK_SIGNATURE'] ?? '') as $sig) {
    $ok = $ok || hash_equals($want, $sig);
}
if (!$ok) {
    http_response_code(401);
    exit;
}
$event = json_decode($raw, true);
// если $event['id'] уже обработан — просто ответьте 2xx; иначе поставьте в очередь
http_response_code(204);

{
  "type": "about:blank",
  "title": "Quantity over limit",
  "status": 422,
  "code": "quantity_over_limit",
  "detail": "quantity must be between 1 and 10 for this product"
}