Receive webhooks
Get a signed HTTP request on your server for every order, refund, dispute, ticket, review and subscription event.
Webhooks tell your server the moment something happens in your store, so you can update a database, a spreadsheet, a Discord bot or your accounting.
Add an endpoint
- Go to Webhooks → Add endpoint.
- Enter your URL, for example
https://example.com/hooks/shop. - Choose All events or pick specific ones.
- Click Add webhook and copy the signing secret. It is shown only once.
Events
| Group | Events |
|---|---|
| Orders | order:created, order:paid, order:partial, order:completed, order:cancelled, order:refunded, order:disputed, order:on_hold |
| Products | product:stock_low |
| Support | query:created, query:replied |
| Reviews | feedback:received |
| Subscriptions | subscription:created, subscription:renewed, subscription:cancelled |
What we send
A POST with a JSON body:
{"id": "…", "event": "order:paid", "created_at": "…", "data": { … }}
Verify the signature
Every request has an X-Signature header: the HMAC-SHA512 of the raw body with your signing secret.
$expected = hash_hmac('sha512', file_get_contents('php://input'), $secret);
if (! hash_equals($expected, $_SERVER['HTTP_X_SIGNATURE'] ?? '')) {
http_response_code(401); exit;
}
Retries
Reply with any 2xx status to confirm. Other responses are retried 5 times, from 1 minute up to 6 hours apart.
Test and debug
- Send test sends a sample event.
- Deliveries shows every attempt with its payload and your server's response. Click Resend to send one again.
- Rotate secret issues a new signing secret if the old one leaks.
- Untick Active to pause an endpoint without deleting it.
Still need help? Message our team and we will reply by email.
Contact support