Use Webhooks

Webhooks let Quoflo instantly notify your own systems whenever something happens—orders are paid, subscriptions start, accounts update, and more.

---

1 Create (or edit) a webhook

1. Go to Settings → Connections → Webhooks.
2. Click Add Webhook (or Edit beside an existing one).
3. Fill in:

Field	What it does
Webhook URL	The HTTPS endpoint on your server that will receive the POST.
Secret Token	(optional) Used to generate an X-Signature HMAC header.
Event Types	Select one or more events—or All.
Active	Toggle to pause / resume delivery.
Additional Headers	Key-value pairs (e.g. Authorization: Bearer XYZ).

Click Save.

---

2 Signatures & verification

If you set a Secret Token, every webhook request includes:

X-Signature: sha256=93b2e4…

Compute a SHA-256 HMAC of the raw request body using the same token and compare—only accept the call if they match.

If you prefer, you can omit the Secret Token and supply your own Authorization header in Additional Headers to protect the endpoint.

---

3 Test delivery

1. Trigger the event in Quoflo (e.g. pay an order).
2. In Settings → Connections → Webhooks, open Webhook Logs.
3. Click a log entry to inspect both request and response JSON.

Logs show status, response time, and will retry transient 5xx errors with exponential back-off.

---

4 Event payload format

{
  "id": "evt_123",
  "event_type": "order_paid",
  "created_at": "2024-05-30T18:22:11Z",
  "data": {
    "order": {
      "id": "ord_456",
      "total_cents": 12000,
      "currency": "USD",
      "account_id": "acc_789"
    }
  }
}

• event_type matches what you selected.
• created_at is UTC ISO-8601.
• The data object structure differs per event.

A complete schema is in Developers → API → Webhook Events.

---

5 Rotating tokens & URLs

Need to rotate a secret or move servers?

• Edit the webhook, update the URL or Secret Token, Save.
• Leave the old endpoint active until you confirm you’re receiving from the new one.
• Finally Delete the retired webhook.

Inactive webhooks remain in the list (greyed-out) and can be re-enabled at any time.

---

Troubleshooting

Symptom	Likely Cause	Fix
No requests hitting your server	Firewall or wrong URL	Curl the URL from the internet, ensure 200 OK
401/403 in logs	Signature mismatch	Verify you used the same secret, raw body, SHA-256
Duplicate events	Client retries 5xx	Return 200 within 10 s even if you queue work

Need help? Email support@quoflo.com with the webhook ID and log timestamp.