Best practices
Follow these best practices to improve security and performance when using webhooks.
You should only subscribe to the webhook events that you need. This will reduce the amount of work your server needs to do. For more information, see "Creating webhooks."
You should set a webhook secret for your webhook and verify that the signature of each webhook delivery matches the secret. This helps to ensure that the webhook delivery is from Shopwaive. For more information, see "Validating webhook deliveries."
The webhook secret should be a random string of text with high entropy. You should securely store your webhook secret in a way that your server can access.
You should ensure that your server uses an HTTPS connection. By default, Shopwaive will verify SSL certificates when delivering webhooks. Shopwaive recommends that you leave SSL verification enabled.
You can set up an IP allow list for your server, and add the IP addresses that Shopwaive uses for webhook deliveries. This can block spoofed requests to your server.
Your server should respond with a 2XX response within 10 seconds of receiving a webhook delivery. If your server takes longer than that to respond, then Shopwaive terminates the connection and considers the delivery a failure.
In order to respond in a timely manner, you may want to set up a queue to process webhook payloads asynchronously. Your server can respond when it receives the webhook, and then process the payload in the background without blocking future webhook deliveries. For example, you can use services like Hookdeck or libraries like Resque (Ruby), RQ (Python), or RabbitMQ (Java).
There are multiple webhook event types, and many events can have multiple action types. Shopwaive continues to add new event types and new actions to existing event types. Your application should check the event type and action of a webhook payload before processing the payload. To determine the event type, you can use the X-Shopwaive-Event request header. To determine the action type, you can use the top-level action key in the event payload.
Last updated