Webhooks
Webhooks allow you to receive real-time notifications when events occur in OlaClick. Instead of polling, OlaClick sends a POST to your endpoint every time something relevant happens.
How it works
- You register a URL via the API (see Create Webhook)
- An event occurs in OlaClick
- OlaClick sends a POST to your URL with the event payload
- Your server responds with 2xx to confirm receipt
→ See Available Events for the full list of event types you can subscribe to.
Delivery format
Every delivery is a POST request with the following headers:
| Header | Description |
|---|---|
Content-Type | Always application/json |
source | Always OlaClick |
X-OlaClick-Signature | HMAC-SHA256 signature of the request body, prefixed with sha256= |
And a JSON body with this envelope:
{
"event_type": "ORDER_CREATED",
"event_id": "f47ac10b-58cc-4372-a567-0e02b2c3d479",
"merchant_id": "restaurant_042",
"timestamp": "2026-06-20T15:30:00.000Z",
"data": { ... }
}
| Field | Type | Description |
|---|---|---|
event_type | string | The event that triggered this delivery |
event_id | UUID | Unique ID for this delivery — use for idempotency |
merchant_id | string | The merchant identifier configured in the webhook |
timestamp | ISO 8601 | When the event was produced |
data | object | Event-specific payload (see each event page) |
Verifying signatures
Every delivery is signed with your webhook's signing_secret. See Signature Verification for implementation details in Node.js, Python, Go, PHP, and Ruby.
Retries
If your endpoint doesn't respond with 2xx, OlaClick retries with exponential backoff:
| Attempt | Wait |
|---|---|
| 1 | 30 seconds |
| 2 | 5 minutes |
| 3 | 30 minutes |
| 4 | 2 hours |
Webhooks with persistent failures (10+ consecutive failures for 3+ days) are automatically deactivated.
Timeout
OlaClick waits a maximum of 10 seconds for your response.
Best practices
- Respond 200 immediately and process in background
- Deduplicate by
event_id— the same event may be delivered more than once - Verify signatures — reject requests with invalid or missing
X-OlaClick-Signature