Webhooks

Webhooks allow you to receive real-time notifications when events occur in OlaClick. Instead of polling, OlaClick sends a POST to your endpoint every time something relevant happens.

How it works

1. You register a URL via the API (see Create Webhook in the REST API Reference)
2. An event occurs in OlaClick (e.g. an order is created)
3. OlaClick sends a POST to your URL with the event payload
4. Your server responds with 2xx to confirm receipt

Available events

Event	Description
ORDER_CREATED	A customer completes a new order
ORDER_UPDATED	Order status changes (confirmed, preparing, delivered, cancelled)
ORDER_DELETED	An order is deleted from the system

Delivery format

Every delivery includes the following HTTP headers:

Header	Description
Content-Type	Always application/json
source	Always OlaClick
X-OlaClick-Signature	HMAC-SHA256 signature of the request body, prefixed with sha256=

And a JSON body:

{
  "event_type": "ORDER_CREATED",
  "event_id": "unique-event-uuid",
  "merchant_id": "restaurant_042",
  "timestamp": "2026-06-20T15:30:00.000Z",
  "data": { ... }
}

Use event_id for idempotency — the same event may be delivered more than once due to retries.

Verifying webhook signatures

Every webhook delivery is signed with your webhook's signing_secret using HMAC-SHA256. This allows you to verify that the payload was sent by OlaClick and has not been tampered with.

The signature is sent in the X-OlaClick-Signature header with the format:

X-OlaClick-Signature: sha256=<hex-encoded-hmac>

Verification steps

1. Extract the X-OlaClick-Signature header from the request
2. Compute the HMAC-SHA256 of the raw request body using your signing_secret
3. Compare the computed signature with the one in the header (use timing-safe comparison)

Example (Node.js)

const crypto = require('crypto');

function verifySignature(body, secret, signatureHeader) {
  const expectedSignature =
    'sha256=' + crypto.createHmac('sha256', secret).update(body).digest('hex');

  return crypto.timingSafeEqual(Buffer.from(expectedSignature), Buffer.from(signatureHeader));
}

// In your webhook handler:
const rawBody = req.rawBody; // raw string body
const signature = req.headers['x-olaclick-signature'];
const isValid = verifySignature(rawBody, YOUR_SIGNING_SECRET, signature);

Example (Python)

import hmac
import hashlib

def verify_signature(body: bytes, secret: str, signature_header: str) -> bool:
    expected = 'sha256=' + hmac.new(
        secret.encode(), body, hashlib.sha256
    ).hexdigest()
    return hmac.compare_digest(expected, signature_header)

Important notes

• Always use the raw request body (not a parsed/re-serialized version) for verification
• Use timing-safe comparison to prevent timing attacks
• The signing_secret is returned when you create or update a webhook via the API

Retries

If your endpoint doesn't respond with a success code, OlaClick retries up to max_retry times with exponential backoff (30s, 60s, 120s, ...).

Best practices

• Respond 200 immediately and process in background
• Deduplicate by event_id
• Verify the X-OlaClick-Signature header to authenticate deliveries
• Use the raw request body (not re-serialized JSON) for signature verification

API Reference

The full CRUD for managing webhooks is in the REST API Reference under the Webhooks section.