Getting started

Webhooks

Webhooks push events to your server the moment they happen, so you can sync orders, fire fulfilment, or update your own systems without polling.

Roadmap: webhooks are not yet available

The delivery system (signing, retries, an admin UI for registering endpoints) is on the build list. The shape documented below is the contract we're building toward - bookmark this page, or email dev@shoprocket.io to be notified at launch.

Overview

Register an HTTPS endpoint in the dashboard (or via the private API) and choose which events to receive. Shoprocket POSTs a JSON payload to that URL each time a subscribed event fires.

Acknowledge fast

Your endpoint must respond with a 2xx status within a few seconds. Do the slow work (emails, ERP sync) asynchronously after acknowledging the event.

Event types

Field	Type	Description
`order.created`	event	A new order was placed.
`order.paid`	event	Payment for an order succeeded.
`order.refunded`	event	An order was fully or partially refunded.
`order.fulfilled`	event	An order was marked fulfilled / shipped.

Payload

Every delivery has the same envelope: an event name, a timestamp, and the relevant object.

Delivery

{
  "event": "order.paid",
  "created_at": "2026-07-15T09:24:11Z",
  "data": {
    "order_id": "ord_123",
    "total": { "amount": 4200, "currency": "USD" },
    "status": "paid"
  }
}

Verifying signatures

Each request carries a X-Shoprocket-Signature header - an HMAC of the raw body signed with your webhook secret. Recompute it and compare before trusting the payload.

Verify (Node)

import crypto from "node:crypto";

const expected = crypto
  .createHmac("sha256", process.env.SHOPROCKET_WEBHOOK_SECRET)
  .update(rawBody)
  .digest("hex");

if (expected !== req.headers["x-shoprocket-signature"]) {
  return res.status(400).end("bad signature");
}

Retries

If your endpoint doesn't return a 2xx, delivery is retried with exponential backoff for up to 24 hours. Make handlers idempotent - the same event may arrive more than once.