Updated 2026-06-01
Webhooks
Event-scoped webhooks with HMAC signing, delivery logs, and a test endpoint.
Webhooks notify your server when events happen in your shop — orders, customers, products, and inventory. Configure multiple endpoints, each scoped to specific events.
Available events
- order.created — a new order is placed
- order.updated — an order changes
- order.cancelled — an order is cancelled
- order.fulfilled — an order is fulfilled
- customer.created — a new customer signs up
- product.updated — a product changes
- inventory.low — stock drops below threshold
Headers
Each delivery includes these headers so you can verify and route the event:
| Field | Type | Description |
|---|---|---|
| X-StoreSuite-Signature | header | HMAC-SHA256 signature of the body using your webhook secret. Verify this on every request. |
| X-StoreSuite-Event | header | The event name (e.g. order.created). |
| Content-Type | header | application/json. |
Verifying the signature
javascript
import crypto from 'crypto';
function verifyWebhook(rawBody, signature, secret) {
const expected = crypto
.createHmac('sha256', secret)
.update(rawBody)
.digest('hex');
return crypto.timingSafeEqual(
Buffer.from(expected),
Buffer.from(signature),
);
}Use the raw body
Compute the HMAC over the raw request body, not a parsed/re-serialized version. JSON re-serialization can change byte ordering and break signature verification.
Management endpoints
Webhook endpoints
GET
/shop/webhooksList shop webhooks (secrets masked).
SessionPOST
/shop/webhooksCreate a webhook (url, label, events, auto-generated secret).
SessionPATCH
/shop/webhooks/:idUpdate webhook (label, url, isActive, events).
SessionDELETE
/shop/webhooks/:idDelete a webhook.
SessionPOST
/shop/webhooks/:id/rotate-secretRotate the webhook HMAC signing secret.
SessionGET
/shop/webhooks/:id/logsPaginated delivery logs.
SessionPOST
/shop/webhooks/:id/testSend a signed webhook.test payload and record a log.
Session