Reference

Webhooks

Subscribe an HTTPS endpoint in your dashboard to receive events as they happen. Every delivery is signed; deliveries are at-least-once, so dedupe on the envelope id.

Events

booking.createdbooking.confirmedbooking.cancelledorder.createdorder.paidorder.status_changedorder.refundedpreorder.invitedpreorder.savedreview.created

Payload envelope

{
  "id": "evt_1709...",
  "event": "order.paid",
  "createdAt": "2025-12-21T19:45:12.000Z",
  "data": { /* event-specific payload */ }
}

Verifying signatures

Each request carries OAC-Signature: t=<unix-ts>,v1=<hex-hmac>. Compute the HMAC of {timestamp}.{rawBody} with your endpoint secret and compare in constant time:

Node.js

import { createHmac, timingSafeEqual } from "crypto";

function verify(rawBody, header, secret) {
  if (!header) return false;
  const parts = Object.fromEntries(header.split(",").map((p) => p.split("=")));
  const ts = parts.t, sig = parts.v1;
  if (!ts || !sig) return false;
  // Reject replays older than 5 minutes.
  if (Math.abs(Date.now() / 1000 - Number(ts)) > 300) return false;
  const expected = createHmac("sha256", secret).update(`${ts}.${rawBody}`).digest("hex");
  return timingSafeEqual(Buffer.from(expected), Buffer.from(sig));
}

Always verify against the raw request body — re-stringifying the JSON breaks the signature.

Retries

A failed delivery (network error or non-2xx within 10s) retries with exponential backoff: 60s → 5m → 30m → 2h → 12h, then stops. Each attempt is recorded as a WebhookDelivery row you can inspect in your dashboard.