Webhooks in Shoporama

Webhooks allow you to have Shoporama automatically send a message to an external service when something happens in your shop. For example, when a new order is created, when a product is updated, or when a customer logs in for the first time. Here we go through what webhooks are, what events you can listen to and how to create them.

What are webhooks?

A webhook is an automatic notification that Shoporama sends to a URL you specify when a certain event occurs. Think of it as a "reverse API". Instead of you asking Shoporama "are there any new orders?", Shoporama tells you automatically.

Without webhooks: Your service asks Shoporama every 5 minutes: "Are there any new orders?". This is inefficient and causes unnecessary load.

With webhooks: Shoporama notifies you instantly when there is a new order. It's fast and runs in real-time.

Available webhook events

You can set up webhooks for the following events. Note that the event names use underscores(order_created), not periods.

Order events

Product and category events

Customer and newsletter events

Checkout events (customer's path through the checkout)

Create a webhook

1. Go to Settings (the gear)
2. Click on the three dots and select Webhooks
3. Click "Create new webhook"
4. Specify the URL to receive the webhook data
5. Select the events you want to listen to (you can select multiple)
6. Click Save

You can also send a test event with the test.ping event directly from the log page to check that your receiver is working.

Format of the webhook payload

When an event is triggered, Shoporama sends an HTTP POST request to your URL with data in JSON format. All webhooks have the same structure:

{ "event":"order_created", "action":"create", "timestamp":"2026-05-01T10:30:00+02:00", "webshop_id": 1234, "data": { "order_id": 56789, "order_no": 1042, "email":"kunde@eksempel.dk", "total": 549.50 } }

The content of the data field varies depending on the event. For order events you get information about the order, for product events information about the product and so on. The data object corresponds to what the REST API returns for that object.

HTTP headers

Each webhook request contains these headers that you can use for verification and routing:

• Content-Type: application/json
• X-Webhook-Event, the name of the event, for example order_created
• X-Webhook-Signature, an HMAC SHA-256 signature in the format sha256=... calculated from the request body and the webhook secret key

Verify signature

If you want to be sure that the request is actually coming from Shoporama, verify the X-Webhook-Signature header with the secret key you can see on your webhook in the Shoporama admin. Example in PHP:

$payload = file_get_contents('php://input'); $expected = 'sha256=' . hash_hmac('sha256', $payload, $secret); if (!hash_equals($expected, $_SERVER['HTTP_X_WEBHOOK_SIGNATURE']) { http_response_code(401); exit; }

Response from your receiving service

Your receiving service should respond with HTTP status 2xx (typically 200) to confirm receipt. Other status codes are logged as errors and you can resend failed deliveries from the log page.

Using webhooks

Typical uses of webhooks:

• Warehouse integration: send new orders automatically to the warehouse, e.g. when paid
• Slack/Teams notification: get notified of new orders in your channel by order_created
• Warehouse sync: update external system when stock fires
• CRM sync: create the customer in Klaviyo, ActiveCampaign or your own CRM by customer_created
• Automation: trigger workflows in Zapier, Make or similar

Logs and resend

For each webhook, you can view a log of all deliveries (response codes, duration, payload and errors). You can filter by event type, status and date. Failed deliveries can be resubmitted manually with one click. Logs are continuously cleared automatically.

Frequently asked questions

Where can I find the webhook list?

Click on the cog in your Shoporama admin and go to Webhooks via the three dots. You can also read our guide to viewing created webhooks in your shop.

How quickly does the webhook appear?

Webhooks are queued and typically sent out within a few seconds. At peak times there may be a slight delay, but never more than a minute or two.

Is there an order_sent event?

No, there isn't. There is no separate event for "sent". When you mark an order as sent, new_status is triggered with the new status in the payload. Listen to that event and check data.status if you want to react to status changes.

Should events be written with periods or underscores?

Underscore. Correct: order_created. Incorrect: order.created. The only event with a period is test.ping, which is used for test deliveries.

Can I listen to multiple events in the same webhook?

Yes, you can. Simply select multiple events when creating or editing the webhook. Use the X-Webhook-Event header or the event field in the payload in your receiver to distinguish them.

What happens if my server is down?

The delivery is logged as failed. You can resend it manually from the log page when your server is back up. We don't automatically retry, so design your recipient to tolerate the occasional webhook arriving later than expected, or retrieve missing orders via the REST API as a backup.

How do I know it's actually Shoporama calling?

Verify the X-Webhook-Signature header with your webhook's secret key. It will appear on your webhook in the Shoporama admin. Compare with an HMAC SHA-256 over the received body. If you don't match, reject the request.

Can I use webhooks with the REST API?

Yes, and it's often a good idea. Use webhooks to get notified and use the REST API to retrieve full data or perform actions based on the event.

How many webhooks can I create?

There is no hard limit in Shoporama. Create as many as you need, but clean up webhooks that are no longer used to avoid unnecessary traffic to defunct URLs.

Do you need help? Contact us at support@shoporama.dk.