Webhooks

Webhooks send chat, contact and order events to your own HTTPS address, signed with a secret. Go to Integrations > Webhooks. On Growth and Pro. One endpoint covers every store on your account. Only the account owner can change it.

Connect#

1. 1

   Enter your endpoint URL

   Any public HTTPS address. Private and internal addresses aren't allowed, and redirects aren't followed.

2. 2

   Pick the events to send and select Connect. We send a test event straight away.

3. 3

   Copy the signing secret

   It's shown once. Select New secret to make another one. The old one stops working at once.

Events#

Each event has the same outer fields as the Zapier events: id, type, created_at, store and data.

Check the signature#

Every request has these headers:

• X-AnyStore-Signature: sha256= and the HMAC-SHA256 of the raw request body, made with your signing secret.
• X-AnyStore-Event: the event type.
• X-AnyStore-Delivery: a unique id. Use it to skip an event you already handled.

import crypto from "node:crypto";

function isValid(rawBody, header, secret) {
  const expected = "sha256=" + crypto.createHmac("sha256", secret).update(rawBody).digest("hex");
  return header.length === expected.length && crypto.timingSafeEqual(Buffer.from(header), Buffer.from(expected));
}

Delivery#

• Answer with a 2xx status within 10 seconds.
• If your endpoint doesn't, we try again after 1, 5 and 30 minutes and 2 hours. Events still waiting after 3 days are dropped.
• Select Send test event any time to check your endpoint.

If something goes wrong#

• Needs attention shows when events stop reaching your endpoint, and the account owner gets an email.
• Turn off Send events to pause without losing the setup. The card shows Paused.
• Disconnect stops events. Any still waiting to be sent are dropped.