Webhook

Verify outbound POSTs with HMAC-SHA256 using your signing secret.

X-Ongapi-Signature
X-Ongapi-Timestamp
X-Ongapi-Event

X-Ongapi-Timestamp is Unix time in seconds. The signature is hex HMAC-SHA256 of `${timestamp}.${rawBody}`, where rawBody is the exact POST body. Compare with a constant-time check. Reject timestamps more than five minutes from your clock.

import { createHmac, timingSafeEqual } from "node:crypto";

function verify(secret, timestamp, rawBody, signature) {
  const expected = createHmac("sha256", secret)
    .update(`${timestamp}.${rawBody}`)
    .digest("hex");
  const a = Buffer.from(expected);
  const b = Buffer.from(signature);
  return a.length === b.length && timingSafeEqual(a, b);
}

Ongapi retries network failures, timeouts, HTTP 429, and HTTP 5xx with exponential backoff, up to eight attempts. Other HTTP 4xx responses, a missing signing secret, and a missing webhook URL fail immediately and are not retried. Respond with HTTP 2xx quickly. Process the payload asynchronously when the work is slow.

Event types include order.created, order.updated (with changed_fields), and connection.reauth_required when a marketplace token must be authorized again.