> ## Documentation Index
> Fetch the complete documentation index at: https://docs.shoply.gg/llms.txt
> Use this file to discover all available pages before exploring further.

# Webhooks

> Have Shoply tell your server when an order is paid, stock runs low, or anything else happens

A webhook is Shoply telling your own server that something happened to your store, the moment it happens. You give it an address and tick the events you want.

> [!NOTE]
>
> For alerts in a Discord channel, you do not need this. Those are set up in **Settings**, under **Notifications**. Webhooks are for a server of your own.

## Adding one

**1. Open Developers, then Webhooks, and press Add webhook**

Enter the `https` address on your server that deliveries are posted to.

**2. Tick the events**

Orders being made, paid, refunded and disputed; subscriptions, Cart Recovery and Payment Routing; stock running low; products, customers and affiliates changing; checkouts your fraud protection turned away. Or take every event. The [full list](/api-reference/webhook-events.md) says when each is sent.

**3. Keep the signing secret**

It is shown once, and starts `shoply_whsec_`. Your server uses it to check that a delivery is Shoply's and not somebody else posting to your address.

A store holds up to 20 endpoints. You are asked to confirm it is you before one is added, moved to another address or given a new secret, and the store's owner is told by email: an order's events carry the buyer's email and what they were sent.

## What your server has to do

1. **Check the signature** on every delivery. [How, in four languages](/api-reference/webhooks.md#checking-the-signature).
2. **Answer `2xx` within five seconds**, and do the work afterwards.
3. **Expect a delivery more than once.** Each carries an ID in `X-Shoply-Delivery` that stays the same when it is sent again.

## The delivery log

An endpoint's card shows how its last twenty deliveries went as a strip: green for taken, red for given up on, amber for one still being tried. One going wrong shows there before you open anything.

Every delivery is listed under **Developers**, then **Activity**, on **Webhook Deliveries**: the event, where it was sent, and whether your server took it. Open one to see the body that was sent and every try, with the status your server answered and the start of what it said, or why it could not be reached.

* **Send a Test**, on an endpoint's card, posts a test event to it now and tells you the answer.
* **Resend**, on a delivery in Activity, sends that delivery again.

A store can ask for 30 tests and resends in ten minutes.

Deliveries are kept for 30 days, up to the newest 50,000 that were taken or given up on.

## When your server is down

A delivery that is not taken is tried again for about a day, at gaps that widen from a minute to twelve hours.

When your server refuses two deliveries in a row, everything for that endpoint waits together. One delivery is tried after a minute, then after longer gaps, up to an hour apart. The first one your server takes sends the rest at once, so nothing is lost by being down for an evening, and a server that is down is not sent a request for every event it missed. **Send a Test** that your server takes does the same straight away.

Up to 5,000 deliveries wait for one endpoint. Past that, new events are not queued for it until some have gone.

An endpoint is sent one delivery at a time, and a store sends one server at most 1,200 a minute. Past that a delivery waits a few seconds. A server that takes two seconds or more to answer is sent its deliveries from a queue for a while, which can make them up to a minute late.

After 20 deliveries in a row have been given up on, the endpoint is paused, and you switch it back on once your server is well.

## Everything else

The [API reference's webhooks page](/api-reference/webhooks.md) has the headers, the body, the retry times and the code to check a signature.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.