Wahio Developers

Get started

1. Add an endpoint

Provide a public HTTP or HTTPS URL that can receive POST requests.

2. Choose events

Select the Wahio events your integration needs and save the secret shown at creation.

3. Verify deliveries

Validate the signature using the raw body, process the event, and return a 2xx response.

Available events

Subscribe each endpoint only to the events it needs.

order.updated

An order is created or its data and status change.

product.updated

A product is created or its catalog information changes.

warehouse-product.updated

Stock or warehouse-specific product information changes.

Delivery headers

X-Wahio-Event

Event type subscribed to by this endpoint.

X-Wahio-Delivery

Unique identifier for this delivery attempt.

X-Wahio-Signature

Base64 HMAC-SHA256 signature of the exact request body.

X-Wahio-Attempt

Current delivery attempt number.

Payload

Payloads use camelCase. This is a shortened order.updated example.

{
  "data": {
    "id": "order-id",
    "accountId": "account-id"
  },
  "isNew": false,
  "occurredAt": "2026-09-05T01:00:00Z",
  "correlationId": "correlation-id"
}

Verify the signature

Save the webhook secret when the subscription is created—it is shown only once. Compute HMAC-SHA256 over the exact raw request body before parsing JSON, then compare the Base64 result with X-Wahio-Signature using a constant-time comparison.

import { createHmac, timingSafeEqual } from "node:crypto";

export function verifyWahioSignature(rawBody, signature, secret) {
  const expected = createHmac("sha256", secret).update(rawBody, "utf8").digest();
  const received = Buffer.from(signature, "base64");

  return received.length === expected.length && timingSafeEqual(received, expected);
}

Retries and responses

Return a 2xx response after accepting a delivery. Wahio retries network failures, HTTP 408, HTTP 429, and 5xx responses using the retry policy configured for the subscription. A webhook is disabled after 10 consecutive delivery failures.

Webhooks