Generate webhook secret

You can generate a webhook secret from the Dashboard. The secret is displayed only once, so be sure to store it securely when it is created.

Important: If you regenerate the webhook secret, all future webhook signatures will be generated using the new secret. Any webhook verification logic still using the old secret will fail, and previously generated signatures cannot be validated with the new secret.

Every outbound webhook request from Strabl includes three headers:

Header	Example	Description
`X-Webhook-Id`	`3fa6c2e1-...`	Unique event ID — use for idempotency
`X-Webhook-Timestamp`	`1747123456`	Unix epoch seconds when the request was signed
`X-Webhook-Signature`	`v1=a3f9...`	`v1=` prefix + HMAC-SHA256 hex digest

Signing Algorithm

Your webhook secret is shown once when you create a webhook endpoint in the Strabl dashboard.

Always:

Read the raw request body before any JSON parsing — parsers may alter whitespace

Reject requests where |now - X-Webhook-Timestamp| > 300 (5 minutes) to block replay attacks

Use constant-time comparison to prevent timing attacks

Event Types

webhookEventType	Fired when
`order_created`	A new order is placed
`order_updated`	An order is marked paid or fulfilled
`order_failed`	Payment fails
`order_refunded`	A refund is issued
`order_abandoned`	A cart is abandoned
`order_chargeback`	A chargeback is opened

Responding to Webhooks

Return HTTP 2xx within 10 seconds

Strabl retries once on non-2xx or timeout

Use X-Webhook-Id to deduplicate — the same event may be delivered more than once

Code Samples

Java

Spring MVC

PHP

Vanilla PHP

Laravel

Python

Flask

Django

Webhook Event Payload

{
  "eventId": "3fa6c2e1-4b2d-4f3a-9c1e-8d7f2a1b5c3d",
  "webhookEventType": "order_created",
  "platformUuid": "plt-abc123",
  "orderUuid": "ord-xyz789",
  "orderShortCode": "SOR-20240514-001",
  "publishedAt": "2024-05-14T10:30:00Z",
  "payload": {}
}

Webhook

Generate webhook secret#

Signing Algorithm#

Event Types#

Responding to Webhooks#

Code Samples#

Webhook Event Payload#

Generate webhook secret

Signing Algorithm

Event Types

Responding to Webhooks

Code Samples

Webhook Event Payload