app.get('/order/success', async (req, res) => {
  const paymentIntentId = req.query.payment_intent;
  
  // Verify payment status server-side
  const response = await fetch(
    `https://paymentgateway.redahaloubi.com/api/v1/payment-intents/${paymentIntentId}`,
    {
      headers: {
        'X-API-Key': process.env.PAYMENT_GATEWAY_API_KEY
      }
    }
  );
  
  const data = await response.json();
  
  if (data.data.status === 'authorized' || data.data.status === 'captured') {
    // Payment successful - fulfill order
    await fulfillOrder(data.data.payment_id);
    res.render('order-success', { payment: data.data });
  } else {
    // Payment not completed
    res.redirect('/order/cancel');
  }
});

@app.route('/order/success')
def order_success():
    payment_intent_id = request.args.get('payment_intent')
    
    # Verify payment status server-side
    response = requests.get(
        f'https://paymentgateway.redahaloubi.com/api/v1/payment-intents/{payment_intent_id}',
        headers={'X-API-Key': os.environ['PAYMENT_GATEWAY_API_KEY']}
    )
    
    data = response.json()
    
    if data['data']['status'] in ['authorized', 'captured']:
        # Payment successful - fulfill order
        fulfill_order(data['data']['payment_id'])
        return render_template('order-success.html', payment=data['data'])
    else:
        # Payment not completed
        return redirect('/order/cancel')

<?php
$paymentIntentId = $_GET['payment_intent'];

// Verify payment status server-side
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, "https://paymentgateway.redahaloubi.com/api/v1/payment-intents/{$paymentIntentId}");
curl_setopt($ch, CURLOPT_HTTPHEADER, [
    'X-API-Key: ' . getenv('PAYMENT_GATEWAY_API_KEY')
]);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
$response = curl_exec($ch);
$data = json_decode($response, true);

if ($data['data']['status'] === 'authorized' || $data['data']['status'] === 'captured') {
    // Payment successful - fulfill order
    fulfillOrder($data['data']['payment_id']);
    include 'order-success.php';
} else {
    // Payment not completed
    header('Location: /order/cancel');
}
?>

const crypto = require('crypto');

app.post('/webhooks/payment', (req, res) => {
  const signature = req.headers['x-webhook-signature'];
  const payload = JSON.stringify(req.body);
  
  // Compute expected signature
  const expected = crypto
    .createHmac('sha256', process.env.WEBHOOK_SECRET)
    .update(payload)
    .digest('hex');
  
  if (signature !== expected) {
    return res.status(401).send('Invalid signature');
  }
  
  // Process webhook
  const event = req.body;
  if (event.event === 'payment.authorized') {
    fulfillOrder(event.data.payment_id);
  }
  
  res.status(200).send('OK');
});

import hmac
import hashlib

@app.route('/webhooks/payment', methods=['POST'])
def webhook():
    signature = request.headers.get('X-Webhook-Signature')
    payload = request.get_data(as_text=True)
    
    # Compute expected signature
    expected = hmac.new(
        os.environ['WEBHOOK_SECRET'].encode(),
        payload.encode(),
        hashlib.sha256
    ).hexdigest()
    
    if signature != expected:
        return 'Invalid signature', 401
    
    # Process webhook
    event = request.json
    if event['event'] == 'payment.authorized':
        fulfill_order(event['data']['payment_id'])
    
    return 'OK', 200