Walkthrough
Webhook Integration Walkthrough
Complete webhook integration walkthrough with configuration, expected results, and recovery guidance.
SoundSync
Webhook Integration Walkthrough
-
Choose the contract
Distinguish developer outbound events, provider callbacks, and WooCommerce inbound events.
-
Endpoint
Use the expected event and signing/verification contract.
-
Verify
Reject untrusted input before changing ownership or commerce state.
-
Deduplicate
Use the supported event/order references and idempotency.
-
Handle retries
Preserve completed work and diagnose failures safely.
-
Reconcile
Check order/line/access outcomes; do not equate a browser return with a verified event.
Use the signing contract for this webhook family
A partner outbound subscription, a payment-provider callback, and an inbound WooCommerce event have different credentials and verification rules. Start with the relevant guide rather than applying a Stripe signature header to every event.
For the partner API, use a relationship-scoped key with webhooks:write to create the HTTPS subscription, select supported events, and save the returned signing secret privately. The secret is shown once. A later rotation is an explicit credential change and must be coordinated with your receiver.
Prove receipt without creating a customer order
Use POST /api/partner/v1/webhooks/test to queue the supported webhook.test event, then inspect /api/partner/v1/webhook-events for its attempt state, status, and retry information. The test message is not a purchase and should not grant a product or create earnings.
At your receiver, verify the family-specific signature using the exact required payload before applying side effects. Deduplicate by the documented event identity and retain the order/line references needed for reconciliation. Return a successful response only after safely accepting the work. If delivery retries, replaying the same event must not issue another serial or reverse a refund twice.
SoundSync
Contract and detailed settings
Read the full guide
Field definitions, permissions, and current limitations.
Test safely
Use permitted test identities and the intended environment. Inspect allowed and rejected outcomes. Keep private customer data, serials, credentials, payment details, and verification links out of published examples.
