Webhooks

Use webhooks to receive selected platform events at your own HTTPS endpoint. An API key can have multiple webhook destinations, so you can send different event groups to different API URLs.

Create Webhook Destinations

Webhook destinations are managed from the developer dashboard, not from the public API reference flow.

1. Log in to your developer account.
2. Open API keys from the account menu.
3. Select the API key mode you want to configure.
4. Click the Webhooks tab.
5. Choose or create the delivery URL that should receive events.
6. Select the event groups for that URL.
7. Save the destination and store the signing secret when it is shown.

You can create multiple destinations for one API key. Use this when different systems should receive different event groups.

Event Selection

The Webhooks tab shows the available events and groups them so they are easier to browse. Commerce extension events use resource-based names such as commerce.product.updated, commerce.order.created, and commerce.shipment.delivered.

Use the event search and accordions to select only the events that should be delivered to that destination.

Signature Verification

Every webhook delivery includes:

Verify the signature by computing HMAC SHA-256 with the stored signing secret over:

{timestamp}.{raw_body}

The signature header value uses this format:

sha256=HEX_DIGEST

Verify against the exact raw request body before JSON parsing. Reject requests with an invalid signature or an old timestamp.

Test Delivery

From the Webhooks tab, use Send test to choose an event type and send a signed test delivery to your endpoint. The webhook activity drawer shows delivery attempts, status, request payload, and receiver response so you can debug your endpoint without writing extra tooling.