Help CenterHelp Center / Developers · Concept
How a Shop Webhook message is sent, what counts as received, when it is retried, and how to verify the signature.
Build your receiver to answer fast, accept repeats and check what it receives. This page gives the exact delivery rules.
| Property | Value |
|---|---|
| Method | POST |
| Body | JSON with event and data. See events and payloads |
| Headers | Content-Type: application/json and Signature |
| TLS | The certificate of an https:// address is verified. An invalid certificate fails the delivery |
| Reply time allowed | 3 seconds |
Any reply with a 2xx status. Any other final status, a timeout or a failed connection counts as a failure.
Answer with 200 as soon as you have stored the message. Do slow work afterwards.
| Try | When |
|---|---|
| 1 | When the event happens |
| 2 | 10 seconds after the first failure |
| 3 | 100 seconds after the second failure |
After the third failure the message is dropped. Nothing records it and nobody is told. The panel has no delivery log and no resend.
Plan for this:
data to ignore repeats.Each request carries a Signature header. It is the lowercase hexadecimal HMAC-SHA256 of the request body, keyed with a signing secret.
To verify a message:
Signature header using a constant-time comparison. Reject the message when they differ.Do not parse the JSON and serialise it again before computing. Any change in spacing or escaping gives a different result.
The panel does not show the signing secret. Ask support for your signing secret.
Good practice for any receiver:
https:// address and keep it private.Create a webhook that points at a request inspector, tick one event, and trigger it in the shop. The What we send card on the form shows the method, the header name, the reply time and the number of tries.