Skip to main content
Webhooks are how OTO tells your systems that something happened, instead of your systems asking repeatedly whether anything has.

​
The three events

​
Setting one up

Register a URL at Settings → Developers → Webhooks, or through POST /rest/v2/webhook. You choose the method, the event type, an authorization key and a secret; every payload is signed with HMAC-SHA256 so your endpoint can prove it came from OTO. Full payloads, the signature scheme and the rules for building an endpoint that survives duplicates and out-of-order delivery are in Webhook events.
Verify the signature — the URL is not a secretAnyone who learns your webhook URL can post to it. Without verification, they can tell your system an order was delivered.Recompute the HMAC, compare in constant time, and reject stale timestamps.

​
The alternative, and why it does not scale

You can poll orderStatus on a timer instead, and on day one it works with no endpoint to host. At volume it means thousands of calls to learn that nothing changed, and the one status you needed arrives up to a polling interval late.