Webhooks

Webhooks

Webhooks let you receive real-time HTTP notifications when events happen in our store — like a product coming back in stock, a price drop, or an order being shipped. They're ideal for developers, businesses with custom integrations, or anyone who wants to automate workflows based on store events.

How webhooks work

When an event you've subscribed to occurs, we send an HTTP POST request to the URL you've configured. Your server receives the event data as a JSON payload and can act on it however you like — update a dashboard, trigger a Slack message, sync inventory, or anything else.

Setting up a webhook

1. Log in to your account and go to Notifications.
2. In the Webhooks section, click "Add Webhook".
3. Enter your webhook URL (must be HTTPS in production).
4. Select the events you want to receive.
5. Optionally scope the webhook to a specific product or collection.
6. Click "Create" — your webhook secret will be shown once. Save it securely.

Available events

• Back in stock — A previously out-of-stock product has new inventory.
• Price drop — A product's price has decreased.
• New product — A new product has been published to the store.
• New in collection — A product has been added to a collection you're watching.
• Order confirmed — One of your orders has been confirmed.
• Order shipped — One of your orders has been shipped with tracking info.

Payload format

All webhook payloads are sent as JSON with a Content-Type: application/json header. Every payload includes these fields:

{
  "event": "back_in_stock",
  "timestamp": "2026-03-01T12:00:00Z",
  "data": {
    "product": {
      "handle": "raspberry-pi-5",
      "title": "Raspberry Pi 5",
      "url": "https://store.example.com/products/raspberry-pi-5",
      "price": "95.00",
      "currency": "AUD"
    },
    "variant": {
      "title": "4GB",
      "sku": "RPI5-4GB",
      "available_quantity": 25
    }
  }
}

Order events include order details instead of product details:

{
  "event": "order_shipped",
  "timestamp": "2026-03-01T14:30:00Z",
  "data": {
    "order": {
      "name": "#1042",
      "status": "fulfilled",
      "tracking_number": "ABC123456",
      "tracking_url": "https://auspost.com.au/track/ABC123456"
    }
  }
}

Verifying webhook signatures

Every webhook request includes an X-Webhook-Signature header containing an HMAC-SHA256 signature of the request body, signed with your webhook secret. You should verify this signature to ensure the request genuinely came from us.

# Ruby example
signature = OpenSSL::HMAC.hexdigest("SHA256", webhook_secret, request_body)
if Rack::Utils.secure_compare(signature, request_header_signature)
  # Authentic request — process it
end

# Python example
import hmac, hashlib
signature = hmac.new(
    webhook_secret.encode(), request_body, hashlib.sha256
).hexdigest()
if hmac.compare_digest(signature, request_header_signature):
    # Authentic request — process it

Retry behaviour and failures

If your endpoint returns a non-2xx status code or times out (after 10 seconds), we'll record the failure. After 10 consecutive failures, the webhook is automatically disabled to avoid unnecessary traffic. You can re-enable it from your Notifications page after fixing the issue.

Scoping webhooks

By default, a webhook fires for all products matching the selected events. You can narrow it by setting a scope:

• Product scope — Only fires for a specific product. Useful if you're monitoring a particular item for restocks.
• Collection scope — Only fires for products within a collection. Useful for watching a category like "Sensors" or "Raspberry Pi".

You can set both scopes on the same webhook — it will only fire when both conditions are met.

Managing your webhooks

All your webhooks are listed on your Notifications page where you can edit, disable, or delete them. If a webhook has been auto-disabled due to failures, you'll see it marked as "Disabled" and can re-enable it after fixing your endpoint.