> For the complete documentation index, see [llms.txt](https://docs.peakcommerce.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.peakcommerce.com/product/settings/developer-tools/webhooks.md).

# Webhooks

**Settings → Webhooks** manages outbound **webhook subscriptions** so your systems receive PeakCommerce events in real time instead of polling the API.

## Why it matters

Webhooks let you react to commerce activity the moment it happens — a new subscription, a completed order, a payment — by pushing a signed JSON payload to an endpoint you control.

## Tabs

* **Subscriptions** — register an endpoint with **Add Webhook**: a public **HTTPS endpoint URL** and the **events** it should receive. Subscribe to specific event types, or use `*` to receive all of them.
* **Delivery Log** — review recent deliveries with their status, HTTP response code, and attempt history to troubleshoot a failing endpoint.

## Delivery format

Each delivery is an HTTP `POST` with a JSON body:

```json
{ "event": "<event type>", "timestamp": "<ISO 8601>", "tenantId": "<your tenant>", "data": { } }
```

Headers sent with every request:

| Header                | Value                                                                                    |
| --------------------- | ---------------------------------------------------------------------------------------- |
| `X-Webhook-Signature` | `sha256=<hmac>` — HMAC-SHA256 of the **raw request body** using your subscription secret |
| `X-Webhook-Event`     | the event type name                                                                      |
| `X-Webhook-Timestamp` | ISO 8601 timestamp of the event                                                          |

## Verification and security

* **Verify the signature.** Compute `HMAC-SHA256(secret, rawBody)` over the *unparsed* body, hex-encode it, and compare (constant-time) against the `X-Webhook-Signature` value after stripping the `sha256=` prefix. The signing secret is shown **once** when the subscription is created — store it securely.
* **Serve HTTPS** and return a `2xx` quickly to acknowledge receipt.

## Retries and dead-lettering

Failed deliveries are retried with **exponential backoff (`2^attempt` seconds)** for up to **5 attempts**. After the fifth failure the delivery is marked **`dead_letter`** — visible in the Delivery Log for diagnosis and replay.

For the full event-type catalog, payload schemas, and replay endpoints, see the Webhooks reference in the **Developers** space. Related: [API Keys](/product/settings/developer-tools/api-keys.md).


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.peakcommerce.com/product/settings/developer-tools/webhooks.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.