Webhooks

Settings → Webhooks manages outbound webhook subscriptions so your systems receive PeakCommerce events in real time instead of polling the API.

Why it matters

Webhooks let you react to commerce activity the moment it happens — a new subscription, a completed order, a payment — by pushing a signed JSON payload to an endpoint you control.

Tabs

• Subscriptions — register an endpoint with Add Webhook: a public HTTPS endpoint URL and the events it should receive. Subscribe to specific event types, or use * to receive all of them.

• Delivery Log — review recent deliveries with their status, HTTP response code, and attempt history to troubleshoot a failing endpoint.

Delivery format

Each delivery is an HTTP POST with a JSON body:

{ "event": "<event type>", "timestamp": "<ISO 8601>", "tenantId": "<your tenant>", "data": { } }

Headers sent with every request:

Header	Value
X-Webhook-Signature	sha256=<hmac> — HMAC-SHA256 of the raw request body using your subscription secret
X-Webhook-Event	the event type name
X-Webhook-Timestamp	ISO 8601 timestamp of the event

Verification and security

• Verify the signature. Compute HMAC-SHA256(secret, rawBody) over the unparsed body, hex-encode it, and compare (constant-time) against the X-Webhook-Signature value after stripping the sha256= prefix. The signing secret is shown once when the subscription is created — store it securely.

• Serve HTTPS and return a 2xx quickly to acknowledge receipt.

Retries and dead-lettering

Failed deliveries are retried with exponential backoff (2^attempt seconds) for up to 5 attempts. After the fifth failure the delivery is marked dead_letter — visible in the Delivery Log for diagnosis and replay.

For the full event-type catalog, payload schemas, and replay endpoints, see the Webhooks reference in the Developers space. Related: API Keys.