Envoyez du WhatsApp
sans toucher à Meta.

use Illuminate\Support\Facades\Http;

$reponse = Http::withHeaders([
    'X-App-ID'  => config('gateway.app_id'),
    'X-API-Key' => config('gateway.api_key'),
])
    ->acceptJson()
    ->timeout(10)
    ->get(config('gateway.url') . '/api/v1/me');

dd($reponse->json());

import 'dart:convert';
import 'package:http/http.dart' as http;

final reponse = await http.get(
  Uri.parse('$baseUrl/api/v1/me'),
  headers: {
    'X-App-ID': appId,
    'X-API-Key': apiKey,
    'Accept': 'application/json',
  },
);

print(jsonDecode(reponse.body));

const reponse = await fetch(
  `${baseUrl}/api/v1/me`,
  {
    headers: {
      'X-App-ID': process.env.GATEWAY_APP_ID,
      'X-API-Key': process.env.GATEWAY_API_KEY,
      'Accept': 'application/json',
    },
  }
);

console.log(await reponse.json());

import os, requests

reponse = requests.get(
    f"{BASE_URL}/api/v1/me",
    headers={
        "X-App-ID": os.environ["GATEWAY_APP_ID"],
        "X-API-Key": os.environ["GATEWAY_API_KEY"],
        "Accept": "application/json",
    },
    timeout=10,
)

print(reponse.json())

class GatewayClient
{
    public function envoyerTexte(string $vers, string $texte): array
    {
        $reponse = Http::withHeaders([
            'X-App-ID'  => config('gateway.app_id'),
            'X-API-Key' => config('gateway.api_key'),
        ])
            ->acceptJson()
            ->timeout(10)
            ->post(config('gateway.url') . '/api/v1/messages/text', [
                'to'   => $vers,
                'text' => $texte,
            ]);

        return $reponse->json();
    }
}

class GatewayClient {
  final String baseUrl, appId, apiKey;

  GatewayClient(this.baseUrl, this.appId, this.apiKey);

  Map<String, String> get _entetes => {
    'X-App-ID': appId,
    'X-API-Key': apiKey,
    'Content-Type': 'application/json',
    'Accept': 'application/json',
  };

  Future<Map<String, dynamic>> envoyerTexte(
    String vers, String texte,
  ) async {
    final reponse = await http.post(
      Uri.parse('$baseUrl/api/v1/messages/text'),
      headers: _entetes,
      body: jsonEncode({'to': vers, 'text': texte}),
    ).timeout(const Duration(seconds: 10));

    return jsonDecode(reponse.body);
  }
}

const entetes = {
  'X-App-ID': process.env.GATEWAY_APP_ID,
  'X-API-Key': process.env.GATEWAY_API_KEY,
  'Content-Type': 'application/json',
  'Accept': 'application/json',
};

async function envoyerTexte(vers, texte) {
  const reponse = await fetch(
    `${baseUrl}/api/v1/messages/text`,
    {
      method: 'POST',
      headers: entetes,
      body: JSON.stringify({ to: vers, text: texte }),
    }
  );

  return reponse.json();
}

ENTETES = {
    "X-App-ID": os.environ["GATEWAY_APP_ID"],
    "X-API-Key": os.environ["GATEWAY_API_KEY"],
    "Accept": "application/json",
}

def envoyer_texte(vers: str, texte: str) -> dict:
    reponse = requests.post(
        f"{BASE_URL}/api/v1/messages/text",
        headers=ENTETES,
        json={"to": vers, "text": texte},
        timeout=10,
    )
    return reponse.json()

public function envoyerTemplate(
    string $vers,
    string $modele,
    array $parametres = [],
    string $langue = 'fr'
): array {
    return Http::withHeaders($this->entetes())
        ->acceptJson()
        ->post($this->url . '/api/v1/messages/template', [
            'to'         => $vers,
            'template'   => $modele,
            'language'   => $langue,
            'parameters' => $parametres,
        ])
        ->json();
}

Future<Map<String, dynamic>> envoyerTemplate({
  required String vers,
  required String modele,
  List<String> parametres = const [],
  String langue = 'fr',
}) async {
  final reponse = await http.post(
    Uri.parse('$baseUrl/api/v1/messages/template'),
    headers: _entetes,
    body: jsonEncode({
      'to': vers,
      'template': modele,
      'language': langue,
      'parameters': parametres,
    }),
  );

  return jsonDecode(reponse.body);
}

async function envoyerTemplate(
  vers, modele, parametres = [], langue = 'fr'
) {
  const reponse = await fetch(
    `${baseUrl}/api/v1/messages/template`,
    {
      method: 'POST',
      headers: entetes,
      body: JSON.stringify({
        to: vers,
        template: modele,
        language: langue,
        parameters: parametres,
      }),
    }
  );

  return reponse.json();
}

def envoyer_template(
    vers: str,
    modele: str,
    parametres: list[str] | None = None,
    langue: str = "fr",
) -> dict:
    reponse = requests.post(
        f"{BASE_URL}/api/v1/messages/template",
        headers=ENTETES,
        json={
            "to": vers,
            "template": modele,
            "language": langue,
            "parameters": parametres or [],
        },
        timeout=10,
    )
    return reponse.json()

public function envoyerOptions(
    string $vers,
    string $message,
    array $options
): array {
    return Http::withHeaders($this->entetes())
        ->acceptJson()
        ->post($this->url . '/api/v1/messages/interactive', [
            'to'      => $vers,
            'body'    => $message,
            'options' => $options,
        ])
        ->json();
}

// Appel
$client->envoyerOptions('+221771234567', 'Que faire ?', [
    ['id' => 'prix',     'title' => 'Consulter les prix'],
    ['id' => 'commande', 'title' => 'Passer commande'],
]);

class OptionGateway {
  final String id;
  final String titre;
  final String? description;

  const OptionGateway({
    required this.id,
    required this.titre,
    this.description,
  });

  Map<String, dynamic> versJson() => {
    'id': id,
    'title': titre,
    if (description != null) 'description': description,
  };
}

Future<Map<String, dynamic>> envoyerOptions({
  required String vers,
  required String message,
  required List<OptionGateway> options,
  String? entete,
}) async {
  final reponse = await http.post(
    Uri.parse('$baseUrl/api/v1/messages/interactive'),
    headers: _entetes,
    body: jsonEncode({
      'to': vers,
      'body': message,
      if (entete != null) 'header': entete,
      'options': options.map((o) => o.versJson()).toList(),
    }),
  );

  return jsonDecode(reponse.body);
}

async function envoyerOptions(vers, message, options, entete) {
  const reponse = await fetch(
    `${baseUrl}/api/v1/messages/interactive`,
    {
      method: 'POST',
      headers: entetes,
      body: JSON.stringify({
        to: vers,
        body: message,
        ...(entete && { header: entete }),
        options,
      }),
    }
  );

  return reponse.json();
}

// Appel
await envoyerOptions('+221771234567', 'Que faire ?', [
  { id: 'prix', title: 'Consulter les prix' },
  { id: 'commande', title: 'Passer commande' },
]);

def envoyer_options(
    vers: str,
    message: str,
    options: list[dict],
    entete: str | None = None,
) -> dict:
    charge = {"to": vers, "body": message, "options": options}

    if entete:
        charge["header"] = entete

    reponse = requests.post(
        f"{BASE_URL}/api/v1/messages/interactive",
        headers=ENTETES,
        json=charge,
        timeout=10,
    )
    return reponse.json()

public function suivre(string $id): array
{
    return Http::withHeaders($this->entetes())
        ->acceptJson()
        ->get($this->url . "/api/v1/messages/{$id}")
        ->json();
}

Future<Map<String, dynamic>> suivre(String id) async {
  final reponse = await http.get(
    Uri.parse('$baseUrl/api/v1/messages/$id'),
    headers: _entetes,
  );

  return jsonDecode(reponse.body);
}

async function suivre(id) {
  const reponse = await fetch(
    `${baseUrl}/api/v1/messages/${id}`,
    { headers: entetes }
  );

  return reponse.json();
}

def suivre(identifiant: str) -> dict:
    reponse = requests.get(
        f"{BASE_URL}/api/v1/messages/{identifiant}",
        headers=ENTETES,
        timeout=10,
    )
    return reponse.json()

public function envoyerCode(string $vers): array
{
    $reponse = Http::withHeaders($this->entetes())
        ->acceptJson()
        ->post($this->url . '/api/v1/otp/send', [
            'to' => $vers,
        ]);

    if ($reponse->status() === 429) {
        throw ValidationException::withMessages([
            'phone' => 'Patientez une minute avant de redemander un code.',
        ]);
    }

    return $reponse->json();
}

Future<Map<String, dynamic>> envoyerCode(String vers) async {
  final reponse = await http.post(
    Uri.parse('$baseUrl/api/v1/otp/send'),
    headers: _entetes,
    body: jsonEncode({'to': vers}),
  );

  if (reponse.statusCode == 429) {
    throw Exception(
      'Patientez une minute avant de redemander un code.',
    );
  }

  return jsonDecode(reponse.body);
}

async function envoyerCode(vers) {
  const reponse = await fetch(
    `${baseUrl}/api/v1/otp/send`,
    {
      method: 'POST',
      headers: entetes,
      body: JSON.stringify({ to: vers }),
    }
  );

  if (reponse.status === 429) {
    throw new Error(
      'Patientez une minute avant de redemander un code.'
    );
  }

  return reponse.json();
}

def envoyer_code(vers: str) -> dict:
    reponse = requests.post(
        f"{BASE_URL}/api/v1/otp/send",
        headers=ENTETES,
        json={"to": vers},
        timeout=10,
    )

    if reponse.status_code == 429:
        raise ValueError(
            "Patientez une minute avant de redemander un code."
        )

    return reponse.json()

public function verifierCode(string $vers, string $code): bool
{
    $reponse = Http::withHeaders($this->entetes())
        ->acceptJson()
        ->post($this->url . '/api/v1/otp/verify', [
            'to'   => $vers,
            'code' => $code,
        ]);

    return $reponse->successful()
        && $reponse->json('verified') === true;
}

Future<bool> verifierCode(String vers, String code) async {
  final reponse = await http.post(
    Uri.parse('$baseUrl/api/v1/otp/verify'),
    headers: _entetes,
    body: jsonEncode({'to': vers, 'code': code}),
  );

  if (reponse.statusCode != 200) return false;

  final corps = jsonDecode(reponse.body);
  return corps['verified'] == true;
}

async function verifierCode(vers, code) {
  const reponse = await fetch(
    `${baseUrl}/api/v1/otp/verify`,
    {
      method: 'POST',
      headers: entetes,
      body: JSON.stringify({ to: vers, code }),
    }
  );

  if (!reponse.ok) return false;

  const corps = await reponse.json();
  return corps.verified === true;
}

def verifier_code(vers: str, code: str) -> bool:
    reponse = requests.post(
        f"{BASE_URL}/api/v1/otp/verify",
        headers=ENTETES,
        json={"to": vers, "code": code},
        timeout=10,
    )

    if reponse.status_code != 200:
        return False

    return reponse.json().get("verified") is True

// pubspec.yaml : crypto: ^3.0.0
import 'dart:convert';
import 'package:crypto/crypto.dart';

bool signatureValide({
  required String corpsBrut,
  required String? signature,
  required String? timestamp,
  required String secret,
}) {
  if (signature == null || timestamp == null) return false;

  // Anti-rejeu : 5 minutes
  final maintenant = DateTime.now().millisecondsSinceEpoch ~/ 1000;
  final envoi = int.tryParse(timestamp);

  if (envoi == null || (maintenant - envoi).abs() > 300) {
    return false;
  }

  final hmac = Hmac(sha256, utf8.encode(secret));
  final calcule = hmac.convert(
    utf8.encode('$timestamp.$corpsBrut'),
  );

  final attendu = 'sha256=${calcule.toString()}';

  // Comparaison en temps constant
  if (attendu.length != signature.length) return false;

  var diff = 0;
  for (var i = 0; i < attendu.length; i++) {
    diff |= attendu.codeUnitAt(i) ^ signature.codeUnitAt(i);
  }

  return diff == 0;
}

const crypto = require('crypto');

// Conserver le corps brut au passage
app.use(express.json({
  verify: (req, res, buf) => { req.corpsBrut = buf.toString(); },
}));

app.post('/whatsapp/callback', (req, res) => {
  const signature = req.get('X-Gateway-Signature');
  const timestamp = req.get('X-Gateway-Timestamp');
  const secret = process.env.GATEWAY_CALLBACK_SECRET;

  if (!signature || !timestamp) {
    return res.status(403).json({ error: 'invalid_signature' });
  }

  // Anti-rejeu
  const maintenant = Math.floor(Date.now() / 1000);
  if (Math.abs(maintenant - Number(timestamp)) > 300) {
    return res.status(403).json({ error: 'expired' });
  }

  const attendu = 'sha256=' + crypto
    .createHmac('sha256', secret)
    .update(`${timestamp}.${req.corpsBrut}`)
    .digest('hex');

  const valide =
    attendu.length === signature.length &&
    crypto.timingSafeEqual(
      Buffer.from(attendu),
      Buffer.from(signature)
    );

  if (!valide) {
    return res.status(403).json({ error: 'invalid_signature' });
  }

  res.json({ status: 'ok' });            // répondre d'abord
  traiterEnArrierePlan(req.body.message);   // traiter ensuite
});

import hashlib, hmac, time
from flask import Flask, request, jsonify

app = Flask(__name__)
SECRET = os.environ["GATEWAY_CALLBACK_SECRET"]


def signature_valide(corps_brut: bytes) -> bool:
    signature = request.headers.get("X-Gateway-Signature")
    timestamp = request.headers.get("X-Gateway-Timestamp")

    if not signature or not timestamp:
        return False

    # Anti-rejeu : 5 minutes
    if abs(time.time() - int(timestamp)) > 300:
        return False

    attendu = "sha256=" + hmac.new(
        SECRET.encode(),
        f"{timestamp}.".encode() + corps_brut,
        hashlib.sha256,
    ).hexdigest()

    return hmac.compare_digest(attendu, signature)


@app.post("/whatsapp/callback")
def recevoir():
    if not signature_valide(request.get_data()):
        return jsonify(error="invalid_signature"), 403

    message = request.json.get("message", {})
    entree = (message.get("selection") or {}).get("id") \
        or message.get("text")

    traiter_en_tache_de_fond(message.get("from"), entree)

    return jsonify(status="ok")