Tell your own software the moment something happens

What this page is for

A webhook is a web address of yours that Slaby calls when something happens in your store. Most shops never need one. It is for when you already use other software and want it updated by itself.

Each call carries only ids and order numbers, never prices or customer details. Your software then fetches what it needs through the Store API with an API key.

You need the Manage settings permission.

Add a webhook in 4 steps

1. 1

   Get a receiving address

   Your developer, or a tool like Zapier, Make or n8n, gives you an https:// address that accepts POST requests. Plain http:// addresses are refused.

2. 2

   Paste it and pick events

   Webhooks → Endpoint URL (https)

   Paste the address. Tick the events you want: Order placed, Order status changed, Product updated. Pick at least one.

3. 3

   Add the webhook and copy its secret

   Add webhook → Copy secret

   Tap Add webhook. The new row shows its secret. Tap Copy secret and give it to whoever runs the receiving system.

4. 4

   Check the signature on every call

   Your receiving system

   Each call has an X-Slaby-Signature header: a sha256 HMAC of the raw request body, made with the secret. Your system works out the same HMAC and ignores calls where it doesn't match.

When your system is down

Your system should answer with any 2xx status within 10 seconds. If it doesn't, Slaby tries again: after 1 minute, 5 minutes, 30 minutes and 2 hours. After 5 failed tries in all, that call is given up.

To pause calls without losing the setup, switch the webhook off with its switch. Switch it on again to resume; calls made while it was off are not sent.

What the fields on this page mean

Endpoint URL (https)

The address Slaby calls. It must start with https://.e.g. https://hooks.zapier.com/hooks/catch/123/abc/

Events

What triggers a call. Order placed: a new order. Order status changed: packed, shipped, delivered, cancelled and so on. Product updated: a product was changed.e.g. Only Order placed, to add each new order to a Google Sheet.

Secret

The code shown on each webhook row. Your system uses it to check the X-Slaby-Signature header, so it can trust the call came from your store.e.g. Copy secret → paste it in your Zapier or server settings.

Active switch

On: calls are sent. Off: the webhook is paused; nothing is sent until you switch it on.e.g. Switch off during maintenance of your ERP.

Delete

Removes the webhook and its delivery history. It can't be undone; add it again to start fresh.e.g. You stopped using Zapier → delete its webhook.

Treat the secret like a password Anyone with the secret can fake calls that look like they came from your store. Share it only with the system that receives the webhook. If it leaks, delete the webhook and add it again to get a new secret.

Read next

• Webhooks guide for developersPayload samples and signature code.
• API keysFetch the order details a webhook points to.
• Store APIEndpoints, scopes and limits.
• Integrations & third-party toolsEverything you can connect.

Common questions

Do I need webhooks to run my store?

No. They only matter if you want another system, like an ERP or a Google Sheet, updated automatically.

It says enter an https:// URL and pick at least one event.

The address must start with https://, and at least one event must be ticked. Fix both and tap Add webhook again.

Why doesn't the webhook include the order total or items?

Calls carry only ids and order numbers, so nothing private travels in them. Your system fetches the details through the Store API with an API key.

How do I check a call really came from my store?

Work out the sha256 HMAC of the raw body with your webhook's secret and compare it with the X-Slaby-Signature header. Ignore calls that don't match.

My server was down for an hour. Did I lose orders?

No. Slaby retries each call after 1 minute, 5 minutes, 30 minutes and 2 hours. A call is given up only after 5 failed tries.

Can I connect Zapier or Make without a developer?

Yes. Create a "catch webhook" trigger there, paste its address here, and tick the events you want.

How do I change the address?

Add a webhook with the new address, check it works, then delete the old one.

My secret leaked. What now?

Delete the webhook and add it again. The new one gets a new secret; update your receiving system with it.