Webhooks

Receive real-time notifications when events occur in a Cartly store.

Available Events

Subscribe to these webhook event types

Name	Type	Required	Description
order.created	event	No	Fired when a new order is placed
order.updated	event	No	Fired when order status changes
order.paid	event	No	Fired when payment is confirmed
product.created	event	No	Fired when a product is created
product.updated	event	No	Fired when a product is modified
product.deleted	event	No	Fired when a product is deleted
customer.created	event	No	Fired when a customer registers
app.uninstalled	event	No	Fired when your app is uninstalled

Verify Webhook Signature (HMAC-SHA256)

javascript

const crypto = require('crypto');

function verifyWebhook(body, signature, secret) {
  const hmac = crypto.createHmac('sha256', secret);
  hmac.update(body, 'utf8');
  const digest = hmac.digest('hex');
  return crypto.timingSafeEqual(
    Buffer.from(signature),
    Buffer.from(digest)
  );
}

Retry Policy

Cartly retries failed webhook deliveries up to 5 times with exponential backoff. After 5 consecutive failures, the subscription is automatically disabled. Re-enable it from the admin panel or via the API.

Expected Response

Your endpoint must return a 2xx status code within 10 seconds. Any other response (or timeout) is treated as a failure.