Webhooks API
Webhook endpoints for receiving notifications from external platforms and sending real-time events to your applications.
Incoming Webhooks
These endpoints receive webhooks from external platforms to trigger download token generation:
Shopify Orders
POST /webhooks/{orgId}/shopifyReceives order completion notifications from Shopify stores.
WooCommerce Orders
POST /webhooks/{orgId}/woocommerceHandles order completions from WooCommerce WordPress sites.
Stripe Payments
POST /webhooks/stripeProcesses successful payments from Stripe checkout sessions.
FastSpring Orders
POST /webhooks/{orgId}/fastspringProcesses order completions from FastSpring.
VibraCart Pro Orders
POST /webhooks/{orgId}/vibracartproReceives order notifications from VibraCart Pro stores.
Download Completion
POST /webhooks/{orgId}/download-completeNotifies when a customer completes a download session.
Webhook Security
Signature Verification
All webhooks include HMAC signatures for verification:
const crypto = require('crypto');
function verifyWebhook(payload, signature, secret) {
const expectedSignature = crypto
.createHmac('sha256', secret)
.update(payload)
.digest('hex');
return crypto.timingSafeEqual(
Buffer.from(signature),
Buffer.from(expectedSignature)
);
}
// Usage
const isValid = verifyWebhook(
req.body,
req.headers['x-continuata-signature'],
process.env.CONTINUATA_WEBHOOK_SECRET
);