Webhooks, die nicht lügen.

Signiert, deduplizierbar und mit stabiler Event-ID wiederholt.

Abonniere Order- und Delivery-Events. Prüfe HMAC-SHA256 über den Raw Body. Jeder Raw Body ist mit HMAC-SHA256 signiert und wird bis zu sechsmal mit derselben Event-ID, demselben Body und derselben Signatur zugestellt.

Katalog

Fünf Events. Abonniere alle oder nur eins.

order.paid A buyer's payment was accepted.
order.failed Payment or checkout processing failed.
order.refunded The order was fully refunded.
delivery.completed A line item was delivered successfully.
delivery.failed A line-item delivery failed.
Headers

Was auf deinem Endpoint landet

POST /your-endpoint
# Standard headers Sellix sets on every delivery
X-Sellix-Event-Id:   7a2327ba-8655-45b4-a768-13e2112b2556
X-Sellix-Event:      order.paid
X-Sellix-Signature:  8f7a9a2b…
Content-Type:        application/json

# The exact raw body covered by X-Sellix-Signature
{
  "id": "7a2327ba-8655-45b4-a768-13e2112b2556",
  "object": "event",
  "event": "order.paid",
  "created_at": "2026-05-26T07:14:22Z",
  "data": { "order": { "uuid": "…", "total_cents": 4900, … } }
}
Interaktiv

HMAC-SHA256 Verifier

Payload und Secret einfügen. Wir berechnen die Signatur live im Browser mit der Web Crypto API - derselbe Algorithmus wie im SDK.

Füge oben eine Signatur ein, um sie zu prüfen.
Implementierung

Dieselbe Prüfung in deiner Sprache


            

Retry Policy

  • Up to 6 attempts per delivery
  • Back-off: 10s → 30s → 2m → 10m → 1h
  • Any 2xx ends the chain; every non-2xx retries
  • After 20 cumulative failed attempts, the endpoint is disabled.

Replay & Dedupe

  • Verify X-Sellix-Signature against the exact raw request body.
  • Dedupe by X-Sellix-Event-Id. Retries keep the same id and body.
  • A replayed event should also return 200 - it's a feature, not a duplicate.