Skip to documentation
SSellix.ggDocs Open dashboard ↗
Reading mode
API playground ↓
Documentation / Webhooks HMAC-SHA256
Simple mode explains every topic in everyday language. Technical details remain available below.

Webhooks that don't lie.

Signed, deduplicable and retried with a stable event id.

Subscribe to order and delivery events. Verify HMAC-SHA256 over the raw body. Every raw body is HMAC-SHA256 signed and retried up to six times with the same event ID, body and signature.

Catalogue

Five events. Subscribe to all or one.

order.paid A buyer's payment was accepted.
order.failed Payment or checkout processing failed.
order.refunded The order was fully refunded.
delivery.completed A line item was delivered successfully.
delivery.failed A line-item delivery failed.
Headers

What lands on your endpoint

POST /your-endpoint
# Standard headers Sellix sets on every delivery
X-Sellix-Event-Id:   7a2327ba-8655-45b4-a768-13e2112b2556
X-Sellix-Event:      order.paid
X-Sellix-Signature:  8f7a9a2b…
Content-Type:        application/json

# The exact raw body covered by X-Sellix-Signature
{
  "id": "7a2327ba-8655-45b4-a768-13e2112b2556",
  "object": "event",
  "event": "order.paid",
  "created_at": "2026-05-26T07:14:22Z",
  "data": { "order": { "uuid": "…", "total_cents": 4900, … } }
}
Interactive

HMAC-SHA256 verifier

Paste a payload + secret. We compute the signature live in your browser using the Web Crypto API - same algorithm our SDK uses on your server.

…
Paste a signature above to check it.
Implementation

Same check, in your language

import crypto from 'node:crypto';

function verifySellixWebhook(rawBody, headers, signingSecret) {
    const sig = headers['x-sellix-signature'] || '';
    const expected = crypto
        .createHmac('sha256', signingSecret)
        .update(rawBody)
        .digest('hex');

    if (!/^[a-f0-9]{64}$/i.test(sig)) return false;
    return crypto.timingSafeEqual(Buffer.from(sig, 'hex'), Buffer.from(expected, 'hex'));
}

Retry policy

  • Up to 6 attempts per delivery
  • Back-off: 10s → 30s → 2m → 10m → 1h
  • Any 2xx ends the chain; every non-2xx retries
  • After 20 cumulative failed attempts, the endpoint is disabled.

Replay & dedupe

  • Verify X-Sellix-Signature against the exact raw request body.
  • Dedupe by X-Sellix-Event-Id. Retries keep the same id and body.
  • A replayed event should also return 200 - it's a feature, not a duplicate.
Keep going

More for builders

API Docs Complete REST API reference, plain-language guides and live testing. Theme docs Build storefront themes with HTML, CSS and Nunjucks. MCP for AI Let AI assistants build, configure and customize your shops. Status Live API reachability and practical integration diagnostics.

LIVE WORKSPACE

API playground

Build a request and inspect the response, right here in the documentation.

Live APIhttps://api.sellix.gg

Real requests to your real account. For test data, use a dedicated test shop and API key. There is no separate REST sandbox.

Kept only in this page’s memory. Sent directly to the Sellix API, never saved in browser storage or included in shared links or generated examples.

Checks health, product access, order access and MCP discovery. Missing permissions are reported separately.

    GET

    Choose a request to get started. Nothing runs automatically.

    Response

    No request yet

    Run a request to see the actual API response here.

    Use on your server

    Replace the placeholder with a server-side secret. Do not include a merchant API key in a public storefront or browser bundle.