Webhooks

Receive store changes at your HTTPS endpoint. Enable the matching read permissions on your connection.

Events

Products

product.created
product.updated
product.deleted

Inventoryinventory.updated

Orders

order.created
order.updated

Verify every delivery

Verify the signature before parsing or applying the body.

X-Storlio-Event
X-Storlio-Timestamp
X-Storlio-Signature:
											sha256=HEX_HMAC

HMAC-SHA256 of timestamp + "." + raw body, using your signing secret. Reject timestamps outside five minutes.

Node.js verification

import { createHmac, timingSafeEqual } from 'node:crypto';

const expected = Buffer.from('sha256=' +
  createHmac('sha256', signingSecret)
    .update(timestamp + '.').update(rawBody).digest('hex'));
const received = Buffer.from(signatureHeader || '');
const fresh = /^\d+$/.test(timestamp) &&
  Math.abs(Date.now() / 1000 - Number(timestamp)) <= 300;

if (!fresh || received.length !== expected.length ||
    !timingSafeEqual(received, expected)) {
  throw new Error('Invalid Storlio webhook');
}

Handle deliveries safely

Save the event and respond with 2xx quickly.
Deduplicate event IDs; delivery is at least once.
Ignore older product/stock versions. Fetch current order state for order events.
Use originConnectionId to recognise your own writes; do not echo them back.

Retries and delivery history

Failures back off from about one minute to six hours. After eight attempts, retry from the connection’s Webhooks tab. Expired or revoked connections stop delivery.