Send store events to your own systems with webhooks
Have Slaby call a URL of yours the moment an order is placed, an order's status changes, or a product is updated — to sync an ERP, a Google Sheet via Zapier/Make/n8n, or your own software. Every call is signed so you can trust it.
About 15 minutes with a tool like Zapier, Make or n8n; longer if you write your own receiver.
Before you start
- An https:// URL that accepts POST requests — from your developer, or a 'catch webhook' trigger in Zapier, Make, n8n or Pabbly.
- Owner or manage-settings access to your Slaby admin (and not a support impersonation session).
Step by step
- 1
Get a receiving URL
In your receiving tool
In Zapier use the 'Webhooks by Zapier → Catch Hook' trigger, in Make the 'Webhooks → Custom webhook' module, in n8n the 'Webhook' node (POST). Each gives you an https:// URL. Your developer can give you an endpoint on your own server instead.
- 2
Add the webhook in Slaby
In your Slaby admin
Go to Settings → Webhooks. Paste the URL into Endpoint URL (https), tick the events you want, and click Add webhook.
The new webhook shows a signing secret with a Copy secret button. Copy it and keep it with your receiver — it is how your receiver checks a call really came from your store.
- Order placed (order.placed) — a buyer placed an order.
- Order status changed (order.status_changed) — confirmed, dispatched, delivered, cancelled, etc.
- Product updated (product.updated) — a product was edited.
- 3
Verify the signature in your receiver
In your receiving system
Every call is a POST with a JSON body and these headers. Compute an HMAC-SHA256 of the RAW request body with your signing secret, write it as hex, prefix it with sha256= and compare it to X-Slaby-Signature. Reject the call if they differ.
Reply with any 2xx status within 10 seconds. Anything else counts as a failure and is retried.
Verify against the raw body exactly as received. Parsing the JSON and re-serialising it changes the bytes and the signature will not match.
- 4
Fetch the details you need
In your receiving system
Webhook bodies are deliberately lean — an order number, a status, a product id — never prices or buyer details. Use the Slaby API (see the API guide) with that id to fetch the full order or product.
Slaby API guide
What each call contains
- Method / type
POST, Content-Type: application/json- X-Slaby-Event
order.placed | order.status_changed | product.updated- X-Slaby-Signature
sha256=<hex HMAC-SHA256 of the raw body, keyed with your signing secret>- X-Slaby-Delivery
a unique id for this delivery — use it to ignore repeats- Body
{"event":"order.placed","data":{"orderNumber":"…","itemCount":2},"sentAt":"2026-10-17T10:00:00.000Z"}order.status_changed carries orderNumber and status; product.updated carries productId.
Failed calls are retried after about 1 minute, 5 minutes, 30 minutes and 2 hours; after the fifth failed attempt the delivery is marked failed. Make your receiver safe to call twice with the same X-Slaby-Delivery.
Test it
- 1.Place a test order on your own store (cash on delivery is fine) — your receiver should get an order.placed call within seconds.
- 2.Change that order's status in the admin — you should get order.status_changed.
- 3.In Zapier/Make/n8n, the trigger's test panel shows the body it received; check X-Slaby-Signature verifies with your secret.
If something goes wrong
Slaby won't save the webhook.
Why it happens: The URL is not https://, is longer than 500 characters, or no event is ticked.
How to fix it: Use an https:// address and tick at least one event.
My receiver gets nothing.
Why it happens: The webhook is switched off, the event is not ticked, or the receiver is not reachable from the internet.
How to fix it: Check the webhook's switch and events on Settings → Webhooks. Test the URL from outside your office network. Localhost addresses cannot receive calls.
The signature never matches.
Why it happens: The body was re-serialised before hashing, or a different webhook's secret is being used.
How to fix it: Hash the raw body bytes. Each webhook has its own secret — copy the one shown on that webhook's row.
Official links
Common questions
- Why doesn't the webhook include the order total or buyer details?
- On purpose. A webhook URL can be copied or leaked; keeping it to ids means nothing sensitive travels that way. Fetch the details through the API with a key you control.
- Can I send webhooks to Google Sheets?
- Yes, through Zapier, Make, n8n or Pabbly: catch the webhook there and add a 'create spreadsheet row' step.