Exemplos em várias linguagens

Exemplos completos e reutilizáveis em cURL, Node.js, Python e PHP. Todos leem a URL e as chaves de variáveis de ambiente — copie, defina as variáveis e execute.

Variáveis de ambiente

export SHARKPAY_BASE_URL="https://sharkpay.com.br"
export SHARKPAY_PUBLIC_KEY="PUB-..."
export SHARKPAY_SECRET_KEY="SEC-..."
export SHARKPAY_TOKEN="..."          # resultado do exemplo "auth"

Autenticação

Obter token

#!/usr/bin/env bash
# Obter token de acesso (chave pública + chave secreta em HTTP Basic)
set -euo pipefail
: "${SHARKPAY_BASE_URL:?}" "${SHARKPAY_PUBLIC_KEY:?}" "${SHARKPAY_SECRET_KEY:?}"
curl -sS --fail-with-body -X POST "$SHARKPAY_BASE_URL/api/auth" \
  -u "$SHARKPAY_PUBLIC_KEY:$SHARKPAY_SECRET_KEY"
echo

// Obter token de acesso — Node.js 18+
const basic = Buffer.from(`${process.env.SHARKPAY_PUBLIC_KEY}:${process.env.SHARKPAY_SECRET_KEY}`).toString('base64');

const res = await fetch(`${process.env.SHARKPAY_BASE_URL}/api/auth`, {
  method: 'POST',
  headers: { Authorization: `Basic ${basic}` },
  signal: AbortSignal.timeout(30_000),
});
const data = await res.json().catch(() => ({}));
if (!res.ok) { console.error(res.status, data); process.exit(1); }

// Guarde o token em memória/cofre e renove ao expirar (expires_in, em segundos).
console.log(JSON.stringify(data.success, null, 2));

# Obter token de acesso — Python 3.9+ (pip install requests)
import os, sys
import requests

res = requests.post(
    os.environ["SHARKPAY_BASE_URL"] + "/api/auth",
    auth=(os.environ["SHARKPAY_PUBLIC_KEY"], os.environ["SHARKPAY_SECRET_KEY"]),  # HTTP Basic
    timeout=30,
)
data = res.json() if res.content else {}
print(res.status_code, data)
sys.exit(0 if res.ok else 1)

<?php
// Obter token de acesso — PHP 8+ com ext-curl
$ch = curl_init(getenv('SHARKPAY_BASE_URL') . '/api/auth');
curl_setopt_array($ch, [
    CURLOPT_POST => true,
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_TIMEOUT => 30,
    CURLOPT_USERPWD => getenv('SHARKPAY_PUBLIC_KEY') . ':' . getenv('SHARKPAY_SECRET_KEY'), // HTTP Basic
]);
$response = curl_exec($ch);
$status = curl_getinfo($ch, CURLINFO_HTTP_CODE);
curl_close($ch);
echo $status, ' ', $response, PHP_EOL;
exit($status === 200 ? 0 : 1);

Cobranças

Criar cobrança Pix

#!/usr/bin/env bash
# Criar cobrança Pix
set -euo pipefail
: "${SHARKPAY_BASE_URL:?defina a URL base, ex.: https://pay.exemplo.com}"
: "${SHARKPAY_TOKEN:?obtenha o token com o exemplo "auth"}"
DUE=$(date -d "+7 days" +%F 2>/dev/null || date -v+7d +%F)  # vencimento daqui a 7 dias
curl -sS --fail-with-body -X POST "$SHARKPAY_BASE_URL/api/pix/create" \
  -H "Authorization: Bearer $SHARKPAY_TOKEN" \
  -H "Idempotency-Key: ${IDEMPOTENCY_KEY:-$(uuidgen)}" \
  -H "Content-Type: application/json" \
  -d '{
  "amount": 100,
  "quantity": 2,
  "discount": 10,
  "tax": 5,
  "invoice_no": "PED-1001",
  "due_date": "'"$DUE"'",
  "item_name": "Camiseta",
  "email": "maria@example.com",
  "document": "12345678909",
  "client": "Maria Souza",
  "notes": "Pedido 1001"
}'
echo

// Criar cobrança Pix — Node.js 18+ (fetch nativo, sem dependências)
import { randomUUID } from 'node:crypto';

const BASE = process.env.SHARKPAY_BASE_URL;
const TOKEN = process.env.SHARKPAY_TOKEN;
const dueDate = new Date(Date.now() + 7 * 864e5).toISOString().slice(0, 10); // vencimento em 7 dias

const body = {
  amount: 100,
  quantity: 2,
  discount: 10,
  tax: 5,
  invoice_no: "PED-1001",
  due_date: dueDate,
  item_name: "Camiseta",
  email: "maria@example.com",
  document: "12345678909",
  client: "Maria Souza",
  notes: "Pedido 1001",
};

const headers = { Authorization: `Bearer ${TOKEN}` };
headers['Content-Type'] = 'application/json';
headers['Idempotency-Key'] = process.env.IDEMPOTENCY_KEY ?? randomUUID(); // reutilize a MESMA chave ao repetir a operação
const res = await fetch(`${BASE}/api/pix/create`, {
  method: 'POST',
  headers,
  body: JSON.stringify(body),
  signal: AbortSignal.timeout(30_000), // sempre defina um timeout
});
const data = await res.json().catch(() => ({}));
console.log(res.status, JSON.stringify(data, null, 2));
if (!res.ok) process.exit(1);

# Criar cobrança Pix — Python 3.9+ (pip install requests)
import os, sys, uuid
from datetime import date, timedelta
import requests

BASE = os.environ["SHARKPAY_BASE_URL"]
TOKEN = os.environ["SHARKPAY_TOKEN"]
due_date = (date.today() + timedelta(days=7)).isoformat()  # vencimento em 7 dias

body = {
    "amount": 100,
    "quantity": 2,
    "discount": 10,
    "tax": 5,
    "invoice_no": "PED-1001",
    "due_date": due_date,
    "item_name": "Camiseta",
    "email": "maria@example.com",
    "document": "12345678909",
    "client": "Maria Souza",
    "notes": "Pedido 1001",
}

headers = {"Authorization": f"Bearer {TOKEN}"}
headers["Idempotency-Key"] = os.environ.get("IDEMPOTENCY_KEY", str(uuid.uuid4()))  # reutilize a MESMA chave ao repetir
res = requests.post(BASE + "/api/pix/create", headers=headers, json=body, timeout=30)
try:
    data = res.json()
except ValueError:
    data = {}
print(res.status_code, data)
sys.exit(0 if res.ok else 1)

<?php
// Criar cobrança Pix — PHP 8+ com ext-curl

$base  = getenv("SHARKPAY_BASE_URL");
$token = getenv("SHARKPAY_TOKEN");
$dueDate = date('Y-m-d', strtotime('+7 days')); // vencimento em 7 dias

$body = [
    'amount' => 100,
    'quantity' => 2,
    'discount' => 10,
    'tax' => 5,
    'invoice_no' => 'PED-1001',
    'due_date' => $dueDate,
    'item_name' => 'Camiseta',
    'email' => 'maria@example.com',
    'document' => '12345678909',
    'client' => 'Maria Souza',
    'notes' => 'Pedido 1001',
];

$ch = curl_init($base . '/api/pix/create');
curl_setopt_array($ch, [
    CURLOPT_CUSTOMREQUEST => "POST",
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_TIMEOUT => 30, // sempre defina um timeout
    CURLOPT_HTTPHEADER => [
        "Authorization: Bearer $token",
        "Content-Type: application/json",
        "Idempotency-Key: " . (getenv("IDEMPOTENCY_KEY") ?: bin2hex(random_bytes(16))), // reutilize a MESMA chave ao repetir
    ],
    CURLOPT_POSTFIELDS => json_encode($body),
]);
$response = curl_exec($ch);
$status = curl_getinfo($ch, CURLINFO_HTTP_CODE);
curl_close($ch);
echo $status, " ", $response, PHP_EOL;
exit($status >= 200 && $status < 300 ? 0 : 1);

Emitir boleto

#!/usr/bin/env bash
# Emitir boleto
set -euo pipefail
: "${SHARKPAY_BASE_URL:?defina a URL base, ex.: https://pay.exemplo.com}"
: "${SHARKPAY_TOKEN:?obtenha o token com o exemplo "auth"}"
DUE=$(date -d "+7 days" +%F 2>/dev/null || date -v+7d +%F)  # vencimento daqui a 7 dias
curl -sS --fail-with-body -X POST "$SHARKPAY_BASE_URL/api/boleto/create" \
  -H "Authorization: Bearer $SHARKPAY_TOKEN" \
  -H "Idempotency-Key: ${IDEMPOTENCY_KEY:-$(uuidgen)}" \
  -H "Content-Type: application/json" \
  -d '{
  "amount": 150,
  "quantity": 1,
  "discount": 0,
  "tax": 0,
  "invoice_no": "PED-1002",
  "due_date": "'"$DUE"'",
  "item_name": "Plano anual",
  "customer": '"$SHARKPAY_CUSTOMER_ID"',
  "instructions": "Não receber após o vencimento"
}'
echo

// Emitir boleto — Node.js 18+ (fetch nativo, sem dependências)
import { randomUUID } from 'node:crypto';

const BASE = process.env.SHARKPAY_BASE_URL;
const TOKEN = process.env.SHARKPAY_TOKEN;
const dueDate = new Date(Date.now() + 7 * 864e5).toISOString().slice(0, 10); // vencimento em 7 dias

const body = {
  amount: 150,
  quantity: 1,
  discount: 0,
  tax: 0,
  invoice_no: "PED-1002",
  due_date: dueDate,
  item_name: "Plano anual",
  customer: Number(process.env.SHARKPAY_CUSTOMER_ID),
  instructions: "Não receber após o vencimento",
};

const headers = { Authorization: `Bearer ${TOKEN}` };
headers['Content-Type'] = 'application/json';
headers['Idempotency-Key'] = process.env.IDEMPOTENCY_KEY ?? randomUUID(); // reutilize a MESMA chave ao repetir a operação
const res = await fetch(`${BASE}/api/boleto/create`, {
  method: 'POST',
  headers,
  body: JSON.stringify(body),
  signal: AbortSignal.timeout(30_000), // sempre defina um timeout
});
const data = await res.json().catch(() => ({}));
console.log(res.status, JSON.stringify(data, null, 2));
if (!res.ok) process.exit(1);

# Emitir boleto — Python 3.9+ (pip install requests)
import os, sys, uuid
from datetime import date, timedelta
import requests

BASE = os.environ["SHARKPAY_BASE_URL"]
TOKEN = os.environ["SHARKPAY_TOKEN"]
due_date = (date.today() + timedelta(days=7)).isoformat()  # vencimento em 7 dias

body = {
    "amount": 150,
    "quantity": 1,
    "discount": 0,
    "tax": 0,
    "invoice_no": "PED-1002",
    "due_date": due_date,
    "item_name": "Plano anual",
    "customer": int(os.environ["SHARKPAY_CUSTOMER_ID"]),
    "instructions": "Não receber após o vencimento",
}

headers = {"Authorization": f"Bearer {TOKEN}"}
headers["Idempotency-Key"] = os.environ.get("IDEMPOTENCY_KEY", str(uuid.uuid4()))  # reutilize a MESMA chave ao repetir
res = requests.post(BASE + "/api/boleto/create", headers=headers, json=body, timeout=30)
try:
    data = res.json()
except ValueError:
    data = {}
print(res.status_code, data)
sys.exit(0 if res.ok else 1)

<?php
// Emitir boleto — PHP 8+ com ext-curl

$base  = getenv("SHARKPAY_BASE_URL");
$token = getenv("SHARKPAY_TOKEN");
$dueDate = date('Y-m-d', strtotime('+7 days')); // vencimento em 7 dias

$body = [
    'amount' => 150,
    'quantity' => 1,
    'discount' => 0,
    'tax' => 0,
    'invoice_no' => 'PED-1002',
    'due_date' => $dueDate,
    'item_name' => 'Plano anual',
    'customer' => (int) getenv("SHARKPAY_CUSTOMER_ID"),
    'instructions' => 'Não receber após o vencimento',
];

$ch = curl_init($base . '/api/boleto/create');
curl_setopt_array($ch, [
    CURLOPT_CUSTOMREQUEST => "POST",
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_TIMEOUT => 30, // sempre defina um timeout
    CURLOPT_HTTPHEADER => [
        "Authorization: Bearer $token",
        "Content-Type: application/json",
        "Idempotency-Key: " . (getenv("IDEMPOTENCY_KEY") ?: bin2hex(random_bytes(16))), // reutilize a MESMA chave ao repetir
    ],
    CURLOPT_POSTFIELDS => json_encode($body),
]);
$response = curl_exec($ch);
$status = curl_getinfo($ch, CURLINFO_HTTP_CODE);
curl_close($ch);
echo $status, " ", $response, PHP_EOL;
exit($status >= 200 && $status < 300 ? 0 : 1);

Cartão de crédito (dados fictícios)

#!/usr/bin/env bash
# Cobrar cartão de crédito
set -euo pipefail
: "${SHARKPAY_BASE_URL:?defina a URL base, ex.: https://pay.exemplo.com}"
: "${SHARKPAY_TOKEN:?obtenha o token com o exemplo "auth"}"
DUE=$(date -d "+7 days" +%F 2>/dev/null || date -v+7d +%F)  # vencimento daqui a 7 dias
curl -sS --fail-with-body -X POST "$SHARKPAY_BASE_URL/api/creditcard/create" \
  -H "Authorization: Bearer $SHARKPAY_TOKEN" \
  -H "Idempotency-Key: ${IDEMPOTENCY_KEY:-$(uuidgen)}" \
  -H "Content-Type: application/json" \
  -d '{
  "amount": 100,
  "quantity": 1,
  "discount": 0,
  "tax": 0,
  "installments": 3,
  "invoice_no": "PED-1003",
  "due_date": "'"$DUE"'",
  "item_name": "Assinatura",
  "email": "maria@example.com",
  "creditcard_holder": "MARIA SOUZA",
  "creditcard_number": "4111111111111111",
  "creditcard_cvv": "123",
  "creditcard_month": 12,
  "creditcard_year": 2030,
  "creditcard_brand": "Visa"
}'
echo

// Cobrar cartão de crédito — Node.js 18+ (fetch nativo, sem dependências)
import { randomUUID } from 'node:crypto';

const BASE = process.env.SHARKPAY_BASE_URL;
const TOKEN = process.env.SHARKPAY_TOKEN;
const dueDate = new Date(Date.now() + 7 * 864e5).toISOString().slice(0, 10); // vencimento em 7 dias

const body = {
  amount: 100,
  quantity: 1,
  discount: 0,
  tax: 0,
  installments: 3,
  invoice_no: "PED-1003",
  due_date: dueDate,
  item_name: "Assinatura",
  email: "maria@example.com",
  creditcard_holder: "MARIA SOUZA",
  creditcard_number: "4111111111111111",
  creditcard_cvv: "123",
  creditcard_month: 12,
  creditcard_year: 2030,
  creditcard_brand: "Visa",
};

const headers = { Authorization: `Bearer ${TOKEN}` };
headers['Content-Type'] = 'application/json';
headers['Idempotency-Key'] = process.env.IDEMPOTENCY_KEY ?? randomUUID(); // reutilize a MESMA chave ao repetir a operação
const res = await fetch(`${BASE}/api/creditcard/create`, {
  method: 'POST',
  headers,
  body: JSON.stringify(body),
  signal: AbortSignal.timeout(30_000), // sempre defina um timeout
});
const data = await res.json().catch(() => ({}));
console.log(res.status, JSON.stringify(data, null, 2));
if (!res.ok) process.exit(1);

# Cobrar cartão de crédito — Python 3.9+ (pip install requests)
import os, sys, uuid
from datetime import date, timedelta
import requests

BASE = os.environ["SHARKPAY_BASE_URL"]
TOKEN = os.environ["SHARKPAY_TOKEN"]
due_date = (date.today() + timedelta(days=7)).isoformat()  # vencimento em 7 dias

body = {
    "amount": 100,
    "quantity": 1,
    "discount": 0,
    "tax": 0,
    "installments": 3,
    "invoice_no": "PED-1003",
    "due_date": due_date,
    "item_name": "Assinatura",
    "email": "maria@example.com",
    "creditcard_holder": "MARIA SOUZA",
    "creditcard_number": "4111111111111111",
    "creditcard_cvv": "123",
    "creditcard_month": 12,
    "creditcard_year": 2030,
    "creditcard_brand": "Visa",
}

headers = {"Authorization": f"Bearer {TOKEN}"}
headers["Idempotency-Key"] = os.environ.get("IDEMPOTENCY_KEY", str(uuid.uuid4()))  # reutilize a MESMA chave ao repetir
res = requests.post(BASE + "/api/creditcard/create", headers=headers, json=body, timeout=30)
try:
    data = res.json()
except ValueError:
    data = {}
print(res.status_code, data)
sys.exit(0 if res.ok else 1)

<?php
// Cobrar cartão de crédito — PHP 8+ com ext-curl

$base  = getenv("SHARKPAY_BASE_URL");
$token = getenv("SHARKPAY_TOKEN");
$dueDate = date('Y-m-d', strtotime('+7 days')); // vencimento em 7 dias

$body = [
    'amount' => 100,
    'quantity' => 1,
    'discount' => 0,
    'tax' => 0,
    'installments' => 3,
    'invoice_no' => 'PED-1003',
    'due_date' => $dueDate,
    'item_name' => 'Assinatura',
    'email' => 'maria@example.com',
    'creditcard_holder' => 'MARIA SOUZA',
    'creditcard_number' => '4111111111111111',
    'creditcard_cvv' => '123',
    'creditcard_month' => 12,
    'creditcard_year' => 2030,
    'creditcard_brand' => 'Visa',
];

$ch = curl_init($base . '/api/creditcard/create');
curl_setopt_array($ch, [
    CURLOPT_CUSTOMREQUEST => "POST",
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_TIMEOUT => 30, // sempre defina um timeout
    CURLOPT_HTTPHEADER => [
        "Authorization: Bearer $token",
        "Content-Type: application/json",
        "Idempotency-Key: " . (getenv("IDEMPOTENCY_KEY") ?: bin2hex(random_bytes(16))), // reutilize a MESMA chave ao repetir
    ],
    CURLOPT_POSTFIELDS => json_encode($body),
]);
$response = curl_exec($ch);
$status = curl_getinfo($ch, CURLINFO_HTTP_CODE);
curl_close($ch);
echo $status, " ", $response, PHP_EOL;
exit($status >= 200 && $status < 300 ? 0 : 1);

Consultar cobrança

#!/usr/bin/env bash
# Consultar cobrança pela referência
set -euo pipefail
: "${SHARKPAY_BASE_URL:?defina a URL base, ex.: https://pay.exemplo.com}"
: "${SHARKPAY_TOKEN:?obtenha o token com o exemplo "auth"}"
curl -sS --fail-with-body -X GET "$SHARKPAY_BASE_URL/api/invoice/ref/$SHARKPAY_REF" \
  -H "Authorization: Bearer $SHARKPAY_TOKEN"
echo

// Consultar cobrança pela referência — Node.js 18+ (fetch nativo, sem dependências)
import { randomUUID } from 'node:crypto';

const BASE = process.env.SHARKPAY_BASE_URL;
const TOKEN = process.env.SHARKPAY_TOKEN;

const headers = { Authorization: `Bearer ${TOKEN}` };
const res = await fetch(`${BASE}/api/invoice/ref/${process.env.SHARKPAY_REF}`, {
  method: 'GET',
  headers,
  signal: AbortSignal.timeout(30_000), // sempre defina um timeout
});
const data = await res.json().catch(() => ({}));
console.log(res.status, JSON.stringify(data, null, 2));
if (!res.ok) process.exit(1);

# Consultar cobrança pela referência — Python 3.9+ (pip install requests)
import os, sys, uuid
import requests

BASE = os.environ["SHARKPAY_BASE_URL"]
TOKEN = os.environ["SHARKPAY_TOKEN"]

headers = {"Authorization": f"Bearer {TOKEN}"}
res = requests.get(BASE + "/api/invoice/ref/" + os.environ["SHARKPAY_REF"] + "", headers=headers, timeout=30)
try:
    data = res.json()
except ValueError:
    data = {}
print(res.status_code, data)
sys.exit(0 if res.ok else 1)

<?php
// Consultar cobrança pela referência — PHP 8+ com ext-curl

$base  = getenv("SHARKPAY_BASE_URL");
$token = getenv("SHARKPAY_TOKEN");

$ch = curl_init($base . '/api/invoice/ref/' . getenv('SHARKPAY_REF'));
curl_setopt_array($ch, [
    CURLOPT_CUSTOMREQUEST => "GET",
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_TIMEOUT => 30, // sempre defina um timeout
    CURLOPT_HTTPHEADER => [
        "Authorization: Bearer $token",
    ],
]);
$response = curl_exec($ch);
$status = curl_getinfo($ch, CURLINFO_HTTP_CODE);
curl_close($ch);
echo $status, " ", $response, PHP_EOL;
exit($status >= 200 && $status < 300 ? 0 : 1);

Listar cobranças

#!/usr/bin/env bash
# Listar cobranças
set -euo pipefail
: "${SHARKPAY_BASE_URL:?defina a URL base, ex.: https://pay.exemplo.com}"
: "${SHARKPAY_TOKEN:?obtenha o token com o exemplo "auth"}"
curl -sS --fail-with-body -X GET "$SHARKPAY_BASE_URL/api/invoices?page=1&limit=10" \
  -H "Authorization: Bearer $SHARKPAY_TOKEN"
echo

// Listar cobranças — Node.js 18+ (fetch nativo, sem dependências)
import { randomUUID } from 'node:crypto';

const BASE = process.env.SHARKPAY_BASE_URL;
const TOKEN = process.env.SHARKPAY_TOKEN;

const headers = { Authorization: `Bearer ${TOKEN}` };
const res = await fetch(`${BASE}/api/invoices?page=1&limit=10`, {
  method: 'GET',
  headers,
  signal: AbortSignal.timeout(30_000), // sempre defina um timeout
});
const data = await res.json().catch(() => ({}));
console.log(res.status, JSON.stringify(data, null, 2));
if (!res.ok) process.exit(1);

# Listar cobranças — Python 3.9+ (pip install requests)
import os, sys, uuid
import requests

BASE = os.environ["SHARKPAY_BASE_URL"]
TOKEN = os.environ["SHARKPAY_TOKEN"]

headers = {"Authorization": f"Bearer {TOKEN}"}
res = requests.get(BASE + "/api/invoices", headers=headers, params={"page": 1, "limit": 10}, timeout=30)
try:
    data = res.json()
except ValueError:
    data = {}
print(res.status_code, data)
sys.exit(0 if res.ok else 1)

<?php
// Listar cobranças — PHP 8+ com ext-curl

$base  = getenv("SHARKPAY_BASE_URL");
$token = getenv("SHARKPAY_TOKEN");

$ch = curl_init($base . '/api/invoices?page=1&limit=10');
curl_setopt_array($ch, [
    CURLOPT_CUSTOMREQUEST => "GET",
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_TIMEOUT => 30, // sempre defina um timeout
    CURLOPT_HTTPHEADER => [
        "Authorization: Bearer $token",
    ],
]);
$response = curl_exec($ch);
$status = curl_getinfo($ch, CURLINFO_HTTP_CODE);
curl_close($ch);
echo $status, " ", $response, PHP_EOL;
exit($status >= 200 && $status < 300 ? 0 : 1);

Repetição segura

#!/usr/bin/env bash
# Repetir a MESMA operação com a MESMA Idempotency-Key: a 2ª chamada devolve a resposta original
# (cabeçalho Idempotent-Replayed: true) e NÃO cria um segundo registro.
set -euo pipefail
: "${SHARKPAY_BASE_URL:?}" "${SHARKPAY_TOKEN:?}"
KEY="pedido-$(date +%s)-retry-demo"
BODY='{"name":"Cliente Idempotente","document":"'$(date +%s)'","document_type":"CPF","zipcode":"01001000","country_id":30,"state":"SP","city":"São Paulo","district":"Sé","street":"Praça da Sé","number":"1","email":"idem-'$(date +%s)'@example.com","phone":"1133334444","mobilephone":"11999998888"}'
for i in 1 2; do
  curl -sS -i -X POST "$SHARKPAY_BASE_URL/api/customer" \
    -H "Authorization: Bearer $SHARKPAY_TOKEN" -H "Content-Type: application/json" \
    -H "Idempotency-Key: $KEY" -d "$BODY" | grep -iE '^(HTTP/|idempotent-replayed)'
done

Clientes

Cadastrar cliente

#!/usr/bin/env bash
# Cadastrar cliente
set -euo pipefail
: "${SHARKPAY_BASE_URL:?defina a URL base, ex.: https://pay.exemplo.com}"
: "${SHARKPAY_TOKEN:?obtenha o token com o exemplo "auth"}"
curl -sS --fail-with-body -X POST "$SHARKPAY_BASE_URL/api/customer" \
  -H "Authorization: Bearer $SHARKPAY_TOKEN" \
  -H "Idempotency-Key: ${IDEMPOTENCY_KEY:-$(uuidgen)}" \
  -H "Content-Type: application/json" \
  -d '{
  "name": "Maria Souza",
  "document": "12345678909",
  "document_type": "CPF",
  "zipcode": "01001000",
  "country_id": 30,
  "state": "SP",
  "city": "São Paulo",
  "district": "Sé",
  "street": "Praça da Sé",
  "number": "100",
  "email": "maria@example.com",
  "phone": "1133334444",
  "mobilephone": "11999998888"
}'
echo

// Cadastrar cliente — Node.js 18+ (fetch nativo, sem dependências)
import { randomUUID } from 'node:crypto';

const BASE = process.env.SHARKPAY_BASE_URL;
const TOKEN = process.env.SHARKPAY_TOKEN;

const body = {
  name: "Maria Souza",
  document: "12345678909",
  document_type: "CPF",
  zipcode: "01001000",
  country_id: 30,
  state: "SP",
  city: "São Paulo",
  district: "Sé",
  street: "Praça da Sé",
  number: "100",
  email: "maria@example.com",
  phone: "1133334444",
  mobilephone: "11999998888",
};

const headers = { Authorization: `Bearer ${TOKEN}` };
headers['Content-Type'] = 'application/json';
headers['Idempotency-Key'] = process.env.IDEMPOTENCY_KEY ?? randomUUID(); // reutilize a MESMA chave ao repetir a operação
const res = await fetch(`${BASE}/api/customer`, {
  method: 'POST',
  headers,
  body: JSON.stringify(body),
  signal: AbortSignal.timeout(30_000), // sempre defina um timeout
});
const data = await res.json().catch(() => ({}));
console.log(res.status, JSON.stringify(data, null, 2));
if (!res.ok) process.exit(1);

# Cadastrar cliente — Python 3.9+ (pip install requests)
import os, sys, uuid
import requests

BASE = os.environ["SHARKPAY_BASE_URL"]
TOKEN = os.environ["SHARKPAY_TOKEN"]

body = {
    "name": "Maria Souza",
    "document": "12345678909",
    "document_type": "CPF",
    "zipcode": "01001000",
    "country_id": 30,
    "state": "SP",
    "city": "São Paulo",
    "district": "Sé",
    "street": "Praça da Sé",
    "number": "100",
    "email": "maria@example.com",
    "phone": "1133334444",
    "mobilephone": "11999998888",
}

headers = {"Authorization": f"Bearer {TOKEN}"}
headers["Idempotency-Key"] = os.environ.get("IDEMPOTENCY_KEY", str(uuid.uuid4()))  # reutilize a MESMA chave ao repetir
res = requests.post(BASE + "/api/customer", headers=headers, json=body, timeout=30)
try:
    data = res.json()
except ValueError:
    data = {}
print(res.status_code, data)
sys.exit(0 if res.ok else 1)

<?php
// Cadastrar cliente — PHP 8+ com ext-curl

$base  = getenv("SHARKPAY_BASE_URL");
$token = getenv("SHARKPAY_TOKEN");

$body = [
    'name' => 'Maria Souza',
    'document' => '12345678909',
    'document_type' => 'CPF',
    'zipcode' => '01001000',
    'country_id' => 30,
    'state' => 'SP',
    'city' => 'São Paulo',
    'district' => 'Sé',
    'street' => 'Praça da Sé',
    'number' => '100',
    'email' => 'maria@example.com',
    'phone' => '1133334444',
    'mobilephone' => '11999998888',
];

$ch = curl_init($base . '/api/customer');
curl_setopt_array($ch, [
    CURLOPT_CUSTOMREQUEST => "POST",
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_TIMEOUT => 30, // sempre defina um timeout
    CURLOPT_HTTPHEADER => [
        "Authorization: Bearer $token",
        "Content-Type: application/json",
        "Idempotency-Key: " . (getenv("IDEMPOTENCY_KEY") ?: bin2hex(random_bytes(16))), // reutilize a MESMA chave ao repetir
    ],
    CURLOPT_POSTFIELDS => json_encode($body),
]);
$response = curl_exec($ch);
$status = curl_getinfo($ch, CURLINFO_HTTP_CODE);
curl_close($ch);
echo $status, " ", $response, PHP_EOL;
exit($status >= 200 && $status < 300 ? 0 : 1);

Saques Pix

Solicitar saque

#!/usr/bin/env bash
# Solicitar saque Pix
set -euo pipefail
: "${SHARKPAY_BASE_URL:?defina a URL base, ex.: https://pay.exemplo.com}"
: "${SHARKPAY_TOKEN:?obtenha o token com o exemplo "auth"}"
curl -sS --fail-with-body -X POST "$SHARKPAY_BASE_URL/api/pixout/create" \
  -H "Authorization: Bearer $SHARKPAY_TOKEN" \
  -H "Idempotency-Key: ${IDEMPOTENCY_KEY:-$(uuidgen)}" \
  -H "Content-Type: application/json" \
  -d '{
  "amount": 50,
  "pixkey": "maria@example.com",
  "keytype": "EMAIL",
  "client": "Maria Souza",
  "document": "12345678909",
  "description": "Repasse"
}'
echo

// Solicitar saque Pix — Node.js 18+ (fetch nativo, sem dependências)
import { randomUUID } from 'node:crypto';

const BASE = process.env.SHARKPAY_BASE_URL;
const TOKEN = process.env.SHARKPAY_TOKEN;

const body = {
  amount: 50,
  pixkey: "maria@example.com",
  keytype: "EMAIL",
  client: "Maria Souza",
  document: "12345678909",
  description: "Repasse",
};

const headers = { Authorization: `Bearer ${TOKEN}` };
headers['Content-Type'] = 'application/json';
headers['Idempotency-Key'] = process.env.IDEMPOTENCY_KEY ?? randomUUID(); // reutilize a MESMA chave ao repetir a operação
const res = await fetch(`${BASE}/api/pixout/create`, {
  method: 'POST',
  headers,
  body: JSON.stringify(body),
  signal: AbortSignal.timeout(30_000), // sempre defina um timeout
});
const data = await res.json().catch(() => ({}));
console.log(res.status, JSON.stringify(data, null, 2));
if (!res.ok) process.exit(1);

# Solicitar saque Pix — Python 3.9+ (pip install requests)
import os, sys, uuid
import requests

BASE = os.environ["SHARKPAY_BASE_URL"]
TOKEN = os.environ["SHARKPAY_TOKEN"]

body = {
    "amount": 50,
    "pixkey": "maria@example.com",
    "keytype": "EMAIL",
    "client": "Maria Souza",
    "document": "12345678909",
    "description": "Repasse",
}

headers = {"Authorization": f"Bearer {TOKEN}"}
headers["Idempotency-Key"] = os.environ.get("IDEMPOTENCY_KEY", str(uuid.uuid4()))  # reutilize a MESMA chave ao repetir
res = requests.post(BASE + "/api/pixout/create", headers=headers, json=body, timeout=30)
try:
    data = res.json()
except ValueError:
    data = {}
print(res.status_code, data)
sys.exit(0 if res.ok else 1)

<?php
// Solicitar saque Pix — PHP 8+ com ext-curl

$base  = getenv("SHARKPAY_BASE_URL");
$token = getenv("SHARKPAY_TOKEN");

$body = [
    'amount' => 50,
    'pixkey' => 'maria@example.com',
    'keytype' => 'EMAIL',
    'client' => 'Maria Souza',
    'document' => '12345678909',
    'description' => 'Repasse',
];

$ch = curl_init($base . '/api/pixout/create');
curl_setopt_array($ch, [
    CURLOPT_CUSTOMREQUEST => "POST",
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_TIMEOUT => 30, // sempre defina um timeout
    CURLOPT_HTTPHEADER => [
        "Authorization: Bearer $token",
        "Content-Type: application/json",
        "Idempotency-Key: " . (getenv("IDEMPOTENCY_KEY") ?: bin2hex(random_bytes(16))), // reutilize a MESMA chave ao repetir
    ],
    CURLOPT_POSTFIELDS => json_encode($body),
]);
$response = curl_exec($ch);
$status = curl_getinfo($ch, CURLINFO_HTTP_CODE);
curl_close($ch);
echo $status, " ", $response, PHP_EOL;
exit($status >= 200 && $status < 300 ? 0 : 1);

Consultar saque

#!/usr/bin/env bash
# Consultar saque
set -euo pipefail
: "${SHARKPAY_BASE_URL:?defina a URL base, ex.: https://pay.exemplo.com}"
: "${SHARKPAY_TOKEN:?obtenha o token com o exemplo "auth"}"
curl -sS --fail-with-body -X GET "$SHARKPAY_BASE_URL/api/pixout/withdraw/$SHARKPAY_WITHDRAW_REF" \
  -H "Authorization: Bearer $SHARKPAY_TOKEN"
echo

// Consultar saque — Node.js 18+ (fetch nativo, sem dependências)
import { randomUUID } from 'node:crypto';

const BASE = process.env.SHARKPAY_BASE_URL;
const TOKEN = process.env.SHARKPAY_TOKEN;

const headers = { Authorization: `Bearer ${TOKEN}` };
const res = await fetch(`${BASE}/api/pixout/withdraw/${process.env.SHARKPAY_WITHDRAW_REF}`, {
  method: 'GET',
  headers,
  signal: AbortSignal.timeout(30_000), // sempre defina um timeout
});
const data = await res.json().catch(() => ({}));
console.log(res.status, JSON.stringify(data, null, 2));
if (!res.ok) process.exit(1);

# Consultar saque — Python 3.9+ (pip install requests)
import os, sys, uuid
import requests

BASE = os.environ["SHARKPAY_BASE_URL"]
TOKEN = os.environ["SHARKPAY_TOKEN"]

headers = {"Authorization": f"Bearer {TOKEN}"}
res = requests.get(BASE + "/api/pixout/withdraw/" + os.environ["SHARKPAY_WITHDRAW_REF"] + "", headers=headers, timeout=30)
try:
    data = res.json()
except ValueError:
    data = {}
print(res.status_code, data)
sys.exit(0 if res.ok else 1)

<?php
// Consultar saque — PHP 8+ com ext-curl

$base  = getenv("SHARKPAY_BASE_URL");
$token = getenv("SHARKPAY_TOKEN");

$ch = curl_init($base . '/api/pixout/withdraw/' . getenv('SHARKPAY_WITHDRAW_REF'));
curl_setopt_array($ch, [
    CURLOPT_CUSTOMREQUEST => "GET",
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_TIMEOUT => 30, // sempre defina um timeout
    CURLOPT_HTTPHEADER => [
        "Authorization: Bearer $token",
    ],
]);
$response = curl_exec($ch);
$status = curl_getinfo($ch, CURLINFO_HTTP_CODE);
curl_close($ch);
echo $status, " ", $response, PHP_EOL;
exit($status >= 200 && $status < 300 ? 0 : 1);

Checkout hospedado

Confirmar pagamento

#!/usr/bin/env bash
# Confirmar pagamento do checkout hospedado
set -euo pipefail
: "${SHARKPAY_BASE_URL:?defina a URL base, ex.: https://pay.exemplo.com}"
: "${SHARKPAY_TOKEN:?obtenha o token com o exemplo "auth"}"
curl -sS --fail-with-body -X GET "$SHARKPAY_BASE_URL/api/checkout/$SHARKPAY_TX_REF" \
  -H "Authorization: Bearer $SHARKPAY_TOKEN"
echo

// Confirmar pagamento do checkout hospedado — Node.js 18+ (fetch nativo, sem dependências)
import { randomUUID } from 'node:crypto';

const BASE = process.env.SHARKPAY_BASE_URL;
const TOKEN = process.env.SHARKPAY_TOKEN;

const headers = { Authorization: `Bearer ${TOKEN}` };
const res = await fetch(`${BASE}/api/checkout/${process.env.SHARKPAY_TX_REF}`, {
  method: 'GET',
  headers,
  signal: AbortSignal.timeout(30_000), // sempre defina um timeout
});
const data = await res.json().catch(() => ({}));
console.log(res.status, JSON.stringify(data, null, 2));
if (!res.ok) process.exit(1);

# Confirmar pagamento do checkout hospedado — Python 3.9+ (pip install requests)
import os, sys, uuid
import requests

BASE = os.environ["SHARKPAY_BASE_URL"]
TOKEN = os.environ["SHARKPAY_TOKEN"]

headers = {"Authorization": f"Bearer {TOKEN}"}
res = requests.get(BASE + "/api/checkout/" + os.environ["SHARKPAY_TX_REF"] + "", headers=headers, timeout=30)
try:
    data = res.json()
except ValueError:
    data = {}
print(res.status_code, data)
sys.exit(0 if res.ok else 1)

<?php
// Confirmar pagamento do checkout hospedado — PHP 8+ com ext-curl

$base  = getenv("SHARKPAY_BASE_URL");
$token = getenv("SHARKPAY_TOKEN");

$ch = curl_init($base . '/api/checkout/' . getenv('SHARKPAY_TX_REF'));
curl_setopt_array($ch, [
    CURLOPT_CUSTOMREQUEST => "GET",
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_TIMEOUT => 30, // sempre defina um timeout
    CURLOPT_HTTPHEADER => [
        "Authorization: Bearer $token",
    ],
]);
$response = curl_exec($ch);
$status = curl_getinfo($ch, CURLINFO_HTTP_CODE);
curl_close($ch);
echo $status, " ", $response, PHP_EOL;
exit($status >= 200 && $status < 300 ? 0 : 1);

Webhooks

Configurar

#!/usr/bin/env bash
# Configurar a URL do webhook
set -euo pipefail
: "${SHARKPAY_BASE_URL:?defina a URL base, ex.: https://pay.exemplo.com}"
: "${SHARKPAY_TOKEN:?obtenha o token com o exemplo "auth"}"
curl -sS --fail-with-body -X PUT "$SHARKPAY_BASE_URL/api/webhook" \
  -H "Authorization: Bearer $SHARKPAY_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
  "url": "'"$WEBHOOK_URL"'"
}'
echo

// Configurar a URL do webhook — Node.js 18+ (fetch nativo, sem dependências)
import { randomUUID } from 'node:crypto';

const BASE = process.env.SHARKPAY_BASE_URL;
const TOKEN = process.env.SHARKPAY_TOKEN;

const body = {
  url: process.env.WEBHOOK_URL,
};

const headers = { Authorization: `Bearer ${TOKEN}` };
headers['Content-Type'] = 'application/json';
const res = await fetch(`${BASE}/api/webhook`, {
  method: 'PUT',
  headers,
  body: JSON.stringify(body),
  signal: AbortSignal.timeout(30_000), // sempre defina um timeout
});
const data = await res.json().catch(() => ({}));
console.log(res.status, JSON.stringify(data, null, 2));
if (!res.ok) process.exit(1);

# Configurar a URL do webhook — Python 3.9+ (pip install requests)
import os, sys, uuid
import requests

BASE = os.environ["SHARKPAY_BASE_URL"]
TOKEN = os.environ["SHARKPAY_TOKEN"]

body = {
    "url": os.environ["WEBHOOK_URL"],
}

headers = {"Authorization": f"Bearer {TOKEN}"}
res = requests.put(BASE + "/api/webhook", headers=headers, json=body, timeout=30)
try:
    data = res.json()
except ValueError:
    data = {}
print(res.status_code, data)
sys.exit(0 if res.ok else 1)

<?php
// Configurar a URL do webhook — PHP 8+ com ext-curl

$base  = getenv("SHARKPAY_BASE_URL");
$token = getenv("SHARKPAY_TOKEN");

$body = [
    'url' => getenv("WEBHOOK_URL"),
];

$ch = curl_init($base . '/api/webhook');
curl_setopt_array($ch, [
    CURLOPT_CUSTOMREQUEST => "PUT",
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_TIMEOUT => 30, // sempre defina um timeout
    CURLOPT_HTTPHEADER => [
        "Authorization: Bearer $token",
        "Content-Type: application/json",
    ],
    CURLOPT_POSTFIELDS => json_encode($body),
]);
$response = curl_exec($ch);
$status = curl_getinfo($ch, CURLINFO_HTTP_CODE);
curl_close($ch);
echo $status, " ", $response, PHP_EOL;
exit($status >= 200 && $status < 300 ? 0 : 1);

Enviar ping

#!/usr/bin/env bash
# Enviar evento de teste
set -euo pipefail
: "${SHARKPAY_BASE_URL:?defina a URL base, ex.: https://pay.exemplo.com}"
: "${SHARKPAY_TOKEN:?obtenha o token com o exemplo "auth"}"
curl -sS --fail-with-body -X POST "$SHARKPAY_BASE_URL/api/webhook/test" \
  -H "Authorization: Bearer $SHARKPAY_TOKEN"
echo

// Enviar evento de teste — Node.js 18+ (fetch nativo, sem dependências)
import { randomUUID } from 'node:crypto';

const BASE = process.env.SHARKPAY_BASE_URL;
const TOKEN = process.env.SHARKPAY_TOKEN;

const headers = { Authorization: `Bearer ${TOKEN}` };
const res = await fetch(`${BASE}/api/webhook/test`, {
  method: 'POST',
  headers,
  signal: AbortSignal.timeout(30_000), // sempre defina um timeout
});
const data = await res.json().catch(() => ({}));
console.log(res.status, JSON.stringify(data, null, 2));
if (!res.ok) process.exit(1);

# Enviar evento de teste — Python 3.9+ (pip install requests)
import os, sys, uuid
import requests

BASE = os.environ["SHARKPAY_BASE_URL"]
TOKEN = os.environ["SHARKPAY_TOKEN"]

headers = {"Authorization": f"Bearer {TOKEN}"}
res = requests.post(BASE + "/api/webhook/test", headers=headers, timeout=30)
try:
    data = res.json()
except ValueError:
    data = {}
print(res.status_code, data)
sys.exit(0 if res.ok else 1)

<?php
// Enviar evento de teste — PHP 8+ com ext-curl

$base  = getenv("SHARKPAY_BASE_URL");
$token = getenv("SHARKPAY_TOKEN");

$ch = curl_init($base . '/api/webhook/test');
curl_setopt_array($ch, [
    CURLOPT_CUSTOMREQUEST => "POST",
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_TIMEOUT => 30, // sempre defina um timeout
    CURLOPT_HTTPHEADER => [
        "Authorization: Bearer $token",
    ],
]);
$response = curl_exec($ch);
$status = curl_getinfo($ch, CURLINFO_HTTP_CODE);
curl_close($ch);
echo $status, " ", $response, PHP_EOL;
exit($status >= 200 && $status < 300 ? 0 : 1);

Verificar assinatura

#!/usr/bin/env bash
# Simula localmente uma entrega assinada para testar o SEU receptor (nenhuma chamada ao SharkPay).
set -euo pipefail
: "${SHARKPAY_WEBHOOK_SECRET:?}" "${RECEIVER_URL:?ex.: http://localhost:3000}"
BODY='{"id":"evt_local_1","type":"ping","created":'$(date +%s)',"api_version":"2026-10-14","data":{"message":"hello"}}'
T=$(date +%s)
SIG=$(printf '%s.%s' "$T" "$BODY" | openssl dgst -sha256 -hmac "$SHARKPAY_WEBHOOK_SECRET" -hex | sed 's/^.* //')
curl -sS -X POST "$RECEIVER_URL" -H "Content-Type: application/json" \
  -H "SharkPay-Signature: t=$T,v1=$SIG" -H "SharkPay-Event-Id: evt_local_1" -d "$BODY"
echo

// Receptor de webhook SharkPay — Node.js 18+ (sem dependências)
import http from 'node:http';
import crypto from 'node:crypto';

const SECRET = process.env.SHARKPAY_WEBHOOK_SECRET;       // whsec_... (mostrado uma única vez)
const TOLERANCE_S = 300;                                   // rejeita eventos com mais de 5 min de diferença

export function verify(secret, header, rawBody, now = Math.floor(Date.now() / 1000)) {
  const parts = Object.fromEntries(String(header ?? '').split(',').map((kv) => kv.trim().split('=')));
  if (!/^\d+$/.test(parts.t ?? '') || !parts.v1) return false;
  if (Math.abs(now - Number(parts.t)) > TOLERANCE_S) return false;
  const expected = crypto.createHmac('sha256', secret).update(`${parts.t}.${rawBody}`).digest('hex');
  const a = Buffer.from(expected), b = Buffer.from(parts.v1);
  return a.length === b.length && crypto.timingSafeEqual(a, b);        // comparação em tempo constante
}

if (process.argv.includes('--selftest')) {                // vetor de teste público
  const sig = `t=1700000000,v1=e089fa65296cc0d43a37342cb8e9cb5f9b62cf38b25577d34d8aaa302b4d5725`;
  const body = "{\"id\":\"evt_test\",\"type\":\"ping\",\"created\":1700000000,\"api_version\":\"2026-10-14\",\"data\":{\"message\":\"hello\"}}";
  const ok = verify('whsec_test_secret', sig, body, 1700000100) && !verify('whsec_test_secret', sig, body + ' ', 1700000100);
  console.log(ok ? 'selftest ok' : 'selftest FALHOU');
  process.exit(ok ? 0 : 1);
}

const seen = new Set();                                    // em produção use banco/Redis (deduplicação por id)
http.createServer((req, res) => {
  const chunks = [];
  req.on('data', (c) => chunks.push(c));
  req.on('end', () => {
    const raw = Buffer.concat(chunks).toString('utf8');      // use o corpo BRUTO, antes de qualquer parse
    if (!verify(SECRET, req.headers['sharkpay-signature'], raw)) { res.writeHead(400).end('bad signature'); return; }
    const event = JSON.parse(raw);
    if (!seen.has(event.id)) {                               // pelo menos uma entrega: ignore duplicatas
      seen.add(event.id);
      console.log('evento', event.type, event.id);           // enfileire o processamento; responda rápido
    }
    res.writeHead(200).end('ok');                            // 2xx em até 10 s
  });
}).listen(process.env.PORT ?? 3000);

# Receptor de webhook SharkPay — Python 3.9+ (somente biblioteca padrão)
import hashlib, hmac, json, os, sys, time
from http.server import BaseHTTPRequestHandler, HTTPServer

SECRET = os.environ.get("SHARKPAY_WEBHOOK_SECRET", "")  # whsec_... (mostrado uma única vez)
TOLERANCE_S = 300                                        # rejeita eventos com mais de 5 min de diferença


def verify(secret: str, header: str, raw_body: str, now: int | None = None) -> bool:
    parts = dict(kv.strip().split("=", 1) for kv in (header or "").split(",") if "=" in kv)
    if not parts.get("t", "").isdigit() or not parts.get("v1"):
        return False
    if abs((now or int(time.time())) - int(parts["t"])) > TOLERANCE_S:
        return False
    expected = hmac.new(secret.encode(), f"{parts['t']}.{raw_body}".encode(), hashlib.sha256).hexdigest()
    return hmac.compare_digest(expected, parts["v1"])    # tempo constante


if "--selftest" in sys.argv:                             # vetor de teste público
    sig = "t=1700000000,v1=e089fa65296cc0d43a37342cb8e9cb5f9b62cf38b25577d34d8aaa302b4d5725"
    body = '{"id":"evt_test","type":"ping","created":1700000000,"api_version":"2026-10-14","data":{"message":"hello"}}'
    ok = verify("whsec_test_secret", sig, body, 1700000100) and not verify("whsec_test_secret", sig, body + " ", 1700000100)
    print("selftest ok" if ok else "selftest FALHOU")
    sys.exit(0 if ok else 1)

seen = set()                                             # em produção use banco/Redis (deduplicação por id)


class Handler(BaseHTTPRequestHandler):
    def do_POST(self):
        raw = self.rfile.read(int(self.headers.get("Content-Length", 0))).decode()  # corpo BRUTO
        if not verify(SECRET, self.headers.get("SharkPay-Signature", ""), raw):
            self.send_response(400); self.end_headers(); return
        event = json.loads(raw)
        if event["id"] not in seen:                      # pelo menos uma entrega: ignore duplicatas
            seen.add(event["id"])
            print("evento", event["type"], event["id"])  # enfileire o processamento; responda rápido
        self.send_response(200); self.end_headers(); self.wfile.write(b"ok")  # 2xx em até 10 s


HTTPServer(("", int(os.environ.get("PORT", 3000))), Handler).serve_forever()

<?php
// Receptor de webhook SharkPay — PHP 8+ (sem dependências). Publique este arquivo atrás de HTTPS.
const TOLERANCE_S = 300; // rejeita eventos com mais de 5 min de diferença

function sharkpay_verify(string $secret, string $header, string $rawBody, ?int $now = null): bool
{
    $parts = [];
    foreach (explode(',', $header) as $kv) {
        $p = explode('=', trim($kv), 2);
        if (count($p) === 2) { $parts[$p[0]] = $p[1]; }
    }
    if (empty($parts['t']) || !ctype_digit($parts['t']) || empty($parts['v1'])) { return false; }
    if (abs(($now ?? time()) - (int) $parts['t']) > TOLERANCE_S) { return false; }
    $expected = hash_hmac('sha256', $parts['t'] . '.' . $rawBody, $secret);
    return hash_equals($expected, $parts['v1']); // tempo constante
}

if (PHP_SAPI === 'cli' && in_array('--selftest', $argv ?? [], true)) { // vetor de teste público
    $sig = 't=1700000000,v1=e089fa65296cc0d43a37342cb8e9cb5f9b62cf38b25577d34d8aaa302b4d5725';
    $body = '{"id":"evt_test","type":"ping","created":1700000000,"api_version":"2026-10-14","data":{"message":"hello"}}';
    $ok = sharkpay_verify('whsec_test_secret', $sig, $body, 1700000100) && !sharkpay_verify('whsec_test_secret', $sig, $body . ' ', 1700000100);
    echo $ok ? "selftest ok\n" : "selftest FALHOU\n";
    exit($ok ? 0 : 1);
}

$raw = file_get_contents('php://input'); // corpo BRUTO, antes de qualquer parse
if (!sharkpay_verify(getenv('SHARKPAY_WEBHOOK_SECRET') ?: '', $_SERVER['HTTP_SHARKPAY_SIGNATURE'] ?? '', $raw)) {
    http_response_code(400); exit('bad signature');
}
$event = json_decode($raw, true);
// Deduplique por $event['id'] (banco/Redis): a entrega é "pelo menos uma vez".
// Enfileire o processamento e responda rápido.
http_response_code(200); echo 'ok'; // 2xx em até 10 s

Diagnosticar entregas

#!/usr/bin/env bash
# Ver entregas recentes
set -euo pipefail
: "${SHARKPAY_BASE_URL:?defina a URL base, ex.: https://pay.exemplo.com}"
: "${SHARKPAY_TOKEN:?obtenha o token com o exemplo "auth"}"
curl -sS --fail-with-body -X GET "$SHARKPAY_BASE_URL/api/webhook/deliveries" \
  -H "Authorization: Bearer $SHARKPAY_TOKEN"
echo

// Ver entregas recentes — Node.js 18+ (fetch nativo, sem dependências)
import { randomUUID } from 'node:crypto';

const BASE = process.env.SHARKPAY_BASE_URL;
const TOKEN = process.env.SHARKPAY_TOKEN;

const headers = { Authorization: `Bearer ${TOKEN}` };
const res = await fetch(`${BASE}/api/webhook/deliveries`, {
  method: 'GET',
  headers,
  signal: AbortSignal.timeout(30_000), // sempre defina um timeout
});
const data = await res.json().catch(() => ({}));
console.log(res.status, JSON.stringify(data, null, 2));
if (!res.ok) process.exit(1);

# Ver entregas recentes — Python 3.9+ (pip install requests)
import os, sys, uuid
import requests

BASE = os.environ["SHARKPAY_BASE_URL"]
TOKEN = os.environ["SHARKPAY_TOKEN"]

headers = {"Authorization": f"Bearer {TOKEN}"}
res = requests.get(BASE + "/api/webhook/deliveries", headers=headers, timeout=30)
try:
    data = res.json()
except ValueError:
    data = {}
print(res.status_code, data)
sys.exit(0 if res.ok else 1)

<?php
// Ver entregas recentes — PHP 8+ com ext-curl

$base  = getenv("SHARKPAY_BASE_URL");
$token = getenv("SHARKPAY_TOKEN");

$ch = curl_init($base . '/api/webhook/deliveries');
curl_setopt_array($ch, [
    CURLOPT_CUSTOMREQUEST => "GET",
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_TIMEOUT => 30, // sempre defina um timeout
    CURLOPT_HTTPHEADER => [
        "Authorization: Bearer $token",
    ],
]);
$response = curl_exec($ch);
$status = curl_getinfo($ch, CURLINFO_HTTP_CODE);
curl_close($ch);
echo $status, " ", $response, PHP_EOL;
exit($status >= 200 && $status < 300 ? 0 : 1);