Order webhooks in, merchant webhooks out

Order webhooks (store to Idukki)

Attribution is reconciled, not modelled: a completed order is matched back to the add-to-cart the widget recorded. That needs the store to tell Idukki about orders. Where that stands per platform:

Merchant webhooks (Idukki to you)

Register any HTTPS URL in the dashboard (Settings, Developers, Webhooks): a Make.com custom webhook, an n8n node, a Zapier catch hook or your own endpoint. Pick the events, set an optional signing secret. Every delivery is a POST with the same envelope.

POST https://your-endpoint.example/idukki
content-type: application/json
x-idukki-signature: sha256=<hex HMAC-SHA256 of the exact body, when a secret is set>

{
  "event": "rights.granted",
  "businessId": "YOUR_BGUID",
  "payload": { … },
  "timestamp": "2026-09-07T10:15:02.412Z"
}

import { createHmac, timingSafeEqual } from 'node:crypto'

export function verifyIdukki(rawBody, header, secret) {
  const expected = 'sha256=' + createHmac('sha256', secret).update(rawBody, 'utf8').digest('hex')
  return header && header.length === expected.length && timingSafeEqual(Buffer.from(header), Buffer.from(expected))
}

Delivery rules

• Fire-and-forget from the product’s hot paths: a slow or failing endpoint never blocks a lead capture, a rights decision or an order.
• Eight-second timeout per delivery. Return a 2xx quickly and do the work asynchronously.
• A 404 or 410 from your endpoint prunes the subscription (the Make.com convention for a deleted scenario). Re-add it in the dashboard.
• The last delivery time and status are shown per webhook in the dashboard.

Event catalogue

Two families. Product events come from the central dispatcher and are what Slack, Zapier, Teams, the helpdesk integrations and outbound webhooks all receive. Widget events are the ones the dashboard’s webhook screen lists for widget and experiment lifecycle.

Webhooks Idukki receives from platforms

For completeness, the inbound routes on the API that platforms call. You do not configure these; the Shopify app and the Stripe integration register them.