Updated 2026-06-01

Webhooks

Event-scoped webhooks with HMAC signing, delivery logs, and a test endpoint.

Webhooks notify your server when events happen in your shop — orders, customers, products, and inventory. Configure multiple endpoints, each scoped to specific events.

Available events

  • order.created — a new order is placed
  • order.updated — an order changes
  • order.cancelled — an order is cancelled
  • order.fulfilled — an order is fulfilled
  • customer.created — a new customer signs up
  • product.updated — a product changes
  • inventory.low — stock drops below threshold

Headers

Each delivery includes these headers so you can verify and route the event:

FieldTypeDescription
X-StoreSuite-SignatureheaderHMAC-SHA256 signature of the body using your webhook secret. Verify this on every request.
X-StoreSuite-EventheaderThe event name (e.g. order.created).
Content-Typeheaderapplication/json.

Verifying the signature

javascript
import crypto from 'crypto';

function verifyWebhook(rawBody, signature, secret) {
  const expected = crypto
    .createHmac('sha256', secret)
    .update(rawBody)
    .digest('hex');
  return crypto.timingSafeEqual(
    Buffer.from(expected),
    Buffer.from(signature),
  );
}

Use the raw body

Compute the HMAC over the raw request body, not a parsed/re-serialized version. JSON re-serialization can change byte ordering and break signature verification.

Management endpoints

Webhook endpoints
GET/shop/webhooks
List shop webhooks (secrets masked).
Session
POST/shop/webhooks
Create a webhook (url, label, events, auto-generated secret).
Session
PATCH/shop/webhooks/:id
Update webhook (label, url, isActive, events).
Session
DELETE/shop/webhooks/:id
Delete a webhook.
Session
POST/shop/webhooks/:id/rotate-secret
Rotate the webhook HMAC signing secret.
Session
GET/shop/webhooks/:id/logs
Paginated delivery logs.
Session
POST/shop/webhooks/:id/test
Send a signed webhook.test payload and record a log.
Session