Webhooks

Security Implementation#

Regsiter Webhooks#

Security Strategies#

✍️ Using Signature

🔑 Using Token

For all created Partner Apps, Salla will assign the signature security strategy by default, as Salla will hash payloads via an auto-generated, reproducable signature token. It will also append two headers to the webhook payload; the security startegy used as in X-Salla-Security-Strategy which is in this context Signature , and a hashed token signature as in 4d7dac8e688eca1c1xxxx

Security Startegy	Header	Token Suffix
Signature	X-Salla-Security-Strategy	X-Salla-Signature

Register Endpoint#

Following is the expected request payload for the Signature security strategy:

webhook_request_body

name

string 

optional

Webhook name. List of Webhook names can be found here.

Example:

Salla Update Customer Event

event

string 

required

Webhook event. List of events can be found here, you can use one from the list.

Example:

customer.updated

url

string 

required

Webhook URL.

Example:

https://webhook.site/07254470-c763-4ee3-bef1-ab2480262814

version

enum<integer> 

optional

Version of the webhook; either valued as 1 or 2.

Allowed values:

12

Example:

2

rule

string 

optional

Operations, expressions and conditions to your webhook. For example, you may use =,!=,AND,OR etc in such a menner: payment_method = YOUR_PAYMENT_METHOD or in combination company_id = 871291 OR price < 50. That adds more capbility to filter the response based on conditions

Example:

payment_method = mada OR price < 50

headers

array [object {2}] 

optional

Webhook headers.

key

string 

optional

Any header key, which its value is sent in the post request to the webhook URL

Example:

Your Secret token key name

value

string 

optional

The value sent to the webhook; for example: cf-ray: 669af54ecf55dfcb-FRA

Example:

Your Secret token value

Verify Webhooks Using Signature#

Once merchants install the app in their stores, Salla uses the Siganture secret startegy (or the default one on app settings) to automatically assign webhook events.

A value for Secret must be given when establishing the webhook in order to allow webhook verification. The request body's 64 character SHA256 hash, which you may find via your partner's dashboard, will then be appended to the X-salla-signature header (e.g. x-salla-signature: ac3ea83628cccf2e98afc34223e4eeb5b41800b77737938aeed4e109f0a0xxxx).

You can also create your own SHA256 hash of the request body using the Secret value to check the signature. Then, using a timing-safe equality function, compare the header value to your own calculated value. Here is an example of how you might accomplish this using Node.js.

Another demonstration can be done using the PHP language to verify a webhook header when receiving a payload. Once the webhook is received, your server can verify it from Salla in the following way:

Timeout#

List of Salla Store Events#

Order#

Product#

Shipping Companies#

Shipments#

Customer#

Category#

Brand#

Store#

Cart#

Invoice#

Special Offer#

Miscellaneous#

Troubleshooting#

Why Webhook Fails#

Set Up Troubleshooting Environment#

Part 1 | Set Up the Webhook Settings in Partners Portal#

Part 2 | Install the App in the demo store#

Note

If the app is already installed on the demo store, you can reinstall it by first uninstalling it. To do this, navigate to the "Webhooks/Notifications" section and go to Dashboard > Menu Bar “More” > Installed Apps.

Then, choose your app from the list of installed apps and uninstall it.

Part 3 | Test the Webhook using the Store dashboard#

Part 4| Check Webhooks events with Salla Webhooks Log#

🔍 Webhook Server Troubleshooting#

🔍 URL Endpoint Access Troubleshooting#

🔍 POST Data Troubleshooting#