curl -X GET https://dummyapi.example.com/invoices/28442 \
-H "x-api-key: DUMMY_KEY"

<?php
$url = 'https://dummyapi.example.com/invoices/28442';
$options = [
  'http' => [
    'header'  => "x-api-key: DUMMY_KEY\r\n",
    'method'  => 'GET'
  ]
];
$context = stream_context_create($options);
$result = file_get_contents($url, false, $context);
if ($result === FALSE) {
  // Handle error
}
echo $result;
?>

using System;
using System.Net.Http;
using System.Threading.Tasks;

class Program
{
    static async Task Main()
    {
        var url = "https://dummyapi.example.com/invoices/28442";
        using (var client = new HttpClient())
        {
            client.DefaultRequestHeaders.Add("x-api-key", "DUMMY_KEY");
            var response = await client.GetAsync(url);
            var responseData = await response.Content.ReadAsStringAsync();
            Console.WriteLine(responseData);
        }
    }
}

<?php
function verifyCallback(array $data, string $token): bool {
    $receivedHash = $data['hash'] ?? '';
    unset($data['hash']);
    $payload = json_encode($data);
    $computedHash = hash_hmac('sha1', $payload, $token);
    return hash_equals($computedHash, $receivedHash);
}

// Example usage:
// $payload = json_decode(file_get_contents('php://input'), true);
// if (verifyCallback($payload, 'YOUR_SECRET_TOKEN')) {
//     echo "Callback is authentic";
// } else {
//     echo "Invalid callback signature";
// }
?>

using System;
using System.Text;
using System.Text.Json;
using System.Security.Cryptography;
using System.Collections.Generic;

public class CallbackVerifier
{
    public static bool VerifyCallback(JsonElement data, string token)
    {
        if (!data.TryGetProperty("hash", out JsonElement hashElement))
            return false;
        string receivedHash = hashElement.GetString();

        // Rebuild a dictionary without the "hash" property
        var dict = new Dictionary<string, object>();
        foreach (var prop in data.EnumerateObject())
        {
            if (prop.Name != "hash")
                dict[prop.Name] = prop.Value;
        }
        string payload = JsonSerializer.Serialize(dict);
        using (var hmac = new HMACSHA1(Encoding.UTF8.GetBytes(token)))
        {
            var computedHashBytes = hmac.ComputeHash(Encoding.UTF8.GetBytes(payload));
            var computedHash = BitConverter.ToString(computedHashBytes).Replace("-", "").ToLower();
            return computedHash == receivedHash;
        }
    }
}

// Example usage:
// JsonElement callbackData = ... // obtained from the request body
// bool isValid = CallbackVerifier.VerifyCallback(callbackData, "YOUR_SECRET_TOKEN");