Webhooks

Webhooks notify you about changes to a branch, its team and its subscription — not about orders.

Setting up an endpoint

Webhook endpoints are configured in the Manager under Manager → Settings → Developers & integrations → Webhooks, not through the API key. The same place has the delivery log (with retry) and the signature-verification guide. Each endpoint gets its own secret, generated when you create it.

Payload

Each delivery is a JSON body with an event field naming the event, plus the related record when there is one:

json$

{
  "event": "BranchMemberAdded",
  "member": { "id": 42, "name": "Jamie", "email": "jamie@example.com" }
}

Verifying signatures

Every delivery is signed with HMAC-SHA256 over the JSON payload, using your endpoint's secret. Verify the Signature header before trusting the body.

ts$

import { createHmac, timingSafeEqual } from "crypto";

const expected = createHmac("sha256", endpointSecret)
  .update(rawBody).digest("hex");

if (!timingSafeEqual(Buffer.from(signatureHeader), Buffer.from(expected))) {
  return new Response("Invalid signature", { status: 401 });
}

Event catalog

BranchUpdatedBranchMemberAddedBranchMemberRemovedBranchMemberRoleUpdatedSubscriptionUpdated

There is no order, payment or menu event yet — only branch, team-membership and subscription changes.

Retries

A non-2xx response is retried up to 3 times total with exponential backoff. There is currently no delivery-id header for deduplication, so make your handler idempotent on the event content itself.