Webhooks in Shoporama

Webhooks allow you to have Shoporama automatically send a notification to an external service whenever something happens in your store. For example, when a new order is created, when a product is updated, or when a customer logs in for the first time. Here, we’ll go over what webhooks are, which events you can listen for, and how to set them up.

What are webhooks?

A webhook is an automatic notification that Shoporama sends to a URL you specify when a specific event occurs. Think of it as a “reverse API.” Instead of you asking Shoporama “are there any new orders?”, Shoporama tells you automatically.

Without webhooks: Your service asks Shoporama every 5 minutes: "Are there any new orders?" This is inefficient and creates unnecessary load.

With webhooks: Shoporama notifies you immediately when a new order arrives. It’s fast and runs in real time.

Available webhook events

You can set up webhooks for the following events. Note that the event names use underscores (order_created), not periods.

Order events

Product and category events

Customer and newsletter events

Checkout events (the customer's journey through checkout)

Create a webhook

1. Go to Settings (the gear icon)
2. Click the three dots and select Webhooks
3. Click "Create new webhook"
4. Enter the URL that should receive the webhook data
5. Select the events you want to listen for (you can select multiple)
6. Click Save

You can also send a test event with the event test.ping directly from the log page to verify that your receiver is working.

Webhook payload format

When an event is triggered, Shoporama sends an HTTP POST request to your URL with data in JSON format. All webhooks have the same structure:

{
  "event": "order_created",
  "action": "create",
  "timestamp": "2026-05-01T10:30:00+02:00",
  "webshop_id": 1234,
  "data": {
    "order_id": 56789,
    "order_no": 1042,
    "email": "kunde@eksempel.dk",
    "total": 549.50
  }
}

The contents of the data field vary depending on the event. For order events, you receive information about the order; for product events, information about the product, and so on. The data object corresponds to what the REST API returns for the object in question.

HTTP Headers

Each webhook request contains these headers, which you can use for authentication and routing:

• Content-Type: application/json
• X-Webhook-Event, the name of the event, e.g., order_created
• X-Webhook-Signature, an HMAC SHA-256 signature in the format sha256=... calculated from the request body and the webhook’s secret key

Verify the signature

If you want to ensure that the request actually comes from Shoporama, verify the X-Webhook-Signature header using the secret key you can find in your webhook settings in the Shoporama admin. Example in PHP:

$payload = file_get_contents('php://input');
$expected = 'sha256=' . hash_hmac('sha256', $payload, $secret);
if (!hash_equals($expected, $_SERVER['HTTP_X_WEBHOOK_SIGNATURE'])) {
    http_response_code(401);
    exit;
}

Response from your recipient

Your receiving service must respond with an HTTP status code of 2xx (typically 200) to confirm receipt. Other status codes are logged as errors, and you can resend failed deliveries from the log page.

Using webhooks

Typical uses of webhooks:

• Warehouse integration: automatically send new orders to the warehouse, e.g., upon payment
• Slack/Teams notification: receive notifications about new orders in your channel via ` order_created`
• Inventory sync: update an external system when stock runs out
• CRM sync: create the customer in Klaviyo, ActiveCampaign, or your own CRM upon ` customer_created`
• Automation: trigger workflows in Zapier, Make, or similar

Logs and retries

For each webhook, you can view a log of all deliveries (response codes, duration, payload, and errors). You can filter by event type, status, and date. Failed deliveries can be resent manually with a single click. Logs are automatically cleared on a regular basis.

Frequently Asked Questions

Where can I find the webhook list?

Click the gear icon in your Shoporama admin and go to Webhooks via the three dots. You can also read our guide to view created webhooks in your shop.

How quickly does the webhook arrive?

Webhooks are queued and typically sent within a few seconds. During peak times, there may be a slight delay, but never more than a minute or two.

Is there an "order_sent" event?

No. There is no separate event for "sent." When you mark an order as sent, the new_status event is triggered with the new status in the payload. Listen for that event and check data.status if you want to respond to status changes.

Should events be written with a period or an underscore?

Underscores. Correct: order_created. Incorrect: order.created. The only event with a period is test.ping, which is used for test deliveries.

Can I listen for multiple events in the same webhook?

Yes. Simply select multiple events when creating or editing the webhook. Use the X-Webhook-Event header or the event field in the payload in your handler to distinguish between them.

What happens if my server is down?

The delivery is logged as failed. You can resend it manually from the log page once your server is back up. We do not automatically retry, so design your receiver to handle the occasional delay in webhook delivery, or retrieve missing orders via the REST API as a backup.

How do I know it’s actually Shoporama calling?

Verify the X-Webhook-Signature header with your webhook’s secret key. It is displayed on your webhook in the Shoporama admin. Compare it with an HMAC SHA-256 of the received body. If they don’t match, reject the request.

Can I use webhooks together with the REST API?

Yes, and it’s often a good idea. Use webhooks to receive notifications, and use the REST API to retrieve full data or perform actions based on the event.

How many webhooks can I create?

There is no hard limit in Shoporama. Create as many as you need, but clean up webhooks that are no longer in use to avoid unnecessary traffic to defunct URLs.

Need help? Contact us at support@shoporama.dk.