# Paystack webhook (Baskit Ops)

Paystack does **not** offer an API to register webhooks. You add the URL in the dashboard; Ops already implements the handler.

## Webhook URL

**Test mode** and **Live mode** each need their own URL (same path, matching secret key mode):

```text
https://baskitops.appnotify.co.za/api/v1/checkout/webhook
```

Callback URL (browser return after hosted checkout — optional override via `BASKIT_PAYSTACK_CALLBACK_URL`):

```text
https://baskitops.appnotify.co.za/api/v1/checkout/callback
```

## Dashboard steps

1. Open [Paystack → Settings → API Keys & Webhooks](https://dashboard.paystack.com/#/settings/developer).
2. Under **Test mode**, paste the webhook URL above → **Save**.
3. Repeat under **Live mode** when you go live (use live secret on Ops + live public key in the APK).
4. Ensure Ops has **`BASKIT_PAYSTACK_SECRET`** set to the **same mode** (test `sk_test_…` with test webhook, etc.).

## Dokploy environment and deploy

1. In the Baskit Ops application, open **Environment** and set:
   - `APP_ANALYTICS_KEY` to the same app key sent in the mobile app's `X-App-Key` header.
   - `BASKIT_PAYSTACK_SECRET` to the Paystack secret for the selected mode (`sk_test_...` or `sk_live_...`).
   - `BASKIT_PAYSTACK_CALLBACK_URL=https://baskitops.appnotify.co.za/api/v1/checkout/callback`.
   - `JWT_SECRET` to an existing random secret of at least 32 characters; keep `JWT_ACCESS_TTL=900` and `JWT_REFRESH_TTL=2592000` unless intentionally changed.
2. Save the environment and redeploy the application with a fresh image build so the updated Compose mappings and entrypoint are used.
3. In the new app container terminal, verify presence without printing secrets:

```sh
for name in APP_ANALYTICS_KEY BASKIT_PAYSTACK_SECRET BASKIT_PAYSTACK_CALLBACK_URL JWT_SECRET; do
    grep -q "^${name}=" /var/www/html/.env && echo "${name}=set" || echo "${name}=MISSING"
done
```

All four values must report `set` before testing checkout.

## Verify after deploy

Ops must be deployed with `Checkout::webhook` routes (404 before deploy is expected).

Inside the Ops container (or local Docker):

```bash
php spark paystack:webhook
php spark paystack:webhook test
php spark paystack:webhook test --url=https://baskitops.appnotify.co.za/api/v1/checkout/webhook
```

Expect **HTTP 200** and `{"ok":true}`. Unsigned POST returns **401** (correct).

## Legacy PHP (soak only)

Until Ops is live, older builds used:

```text
https://baskitapi.appnotify.co.za/index.php?r=pay/webhook
```

Switch Paystack to the Ops URL once `paystack:webhook test` succeeds on production.