Skip to main content

Webhooks

Where: Settings → Webhooks

Settings → Webhooks pushes events to external systems. The page explains: “Each delivery is a signed POST (verify the X-Webhook-Signature HMAC with the endpoint secret)… Leave events empty to receive everything.”

Figure: Settings → Webhooks — HMAC-signed event endpoints with delivery log and replay

Settings → Webhooks — HMAC-signed event endpoints with delivery log and replay

  1. Press “New webhook”: Endpoint URL, optional Description, Events (“comma-separated; blank = all” — e.g. order.status_changed, quote.created), and an Active toggle.
  2. Creating reveals the signing secret once (same copy-now warning as API keys) — your developer uses it to verify each delivery.
  3. Per-endpoint actions: the Delivery log (dialog “Deliveries — ‹url›” with Event / Status / Attempt / HTTP / Error / When, and a per-row Replay — toast “Re-queued for delivery”), Edit, Rotate signing secret, and Delete (‘Delete the webhook for “‹url›”? It will stop receiving events.’).