Webhooks: Overview and Setup
Webhooks make Etalasse notify your systems as soon as something happens in your shop: an order is paid, a product changes, stock runs low, and so on. Etalasse sends a signed JSON POST request to an HTTPS address (endpoint) that you own. They suit connecting accounting, ERP, couriers, or internal notifications without polling for data.
Webhooks are available on the Pro and Enterprise plans. See Webhooks, API and plans.
Delivery is at-least-once with automatic retries. The same event can arrive more than once, so your system needs to ignore duplicates. See the Event catalogue.
Who can use it
Owner and Admin only. Cashiers cannot open anything in this feature, including the log, because the delivery log contains customer data.
Adding an endpoint
- Open Settings > Developers > Webhooks in the Dashboard.
- Choose Add endpoint.
- Fill in the URL (must be HTTPS, see the rules below) and an optional Description (for example "Accounting sync").
- Choose the events you want, grouped by category (orders, refunds, stock, purchase orders, bookings, reviews, customers, products). Choose All events to receive everything, including new events added in the future.
- Save. Etalasse shows the signing secret (starts with
whsec_).
Copy and store the secret right away. Once closed, the Dashboard only shows a short hint (for example whsec_...a1B2). If you lose it, create a new one with secret rotation.
Then send a test to confirm your server receives and verifies the request correctly. How to verify the signature is in Verifying signatures.
URL rules
For security, the URL is checked when saved and again on every delivery:
| Rule | Details |
|---|---|
| Scheme | https only |
| Length | 500 characters at most |
| No credentials or fragments | No user:pass@ or #fragment |
| Host | A public DNS name. No IP addresses (in any notation), localhost, .local, .internal, or bare names |
| Port | 443, or 1024-65535 except common internal service ports (3306, 5432, 6379, 27017, 9200, and similar) |
| Destination address | The host name is resolved when saved and on every delivery. If any answer is a private, loopback, link-local, multicast, reserved, or cloud-metadata address, the endpoint is refused |
| Redirects | Not followed. A 3xx response counts as a failure |
A URL can be registered only once per shop.
Endpoint limits
| Plan | Maximum endpoints |
|---|---|
| Free, Growth | Not available |
| Pro | 3 |
| Enterprise | 10 |
Whatever your plan's limit, one shop cannot have more than 10 endpoints. The Dashboard shows usage as count / limit.
Managing endpoints
The endpoint list shows the URL, number of events, the active switch, status (healthy, failing N times, automatically disabled, or rotating), and the last success time. You can change the URL, description, or events, disable an endpoint, or delete it. Deleting cannot be undone, and queued deliveries are skipped.
Common questions
Do I need a dedicated server? You need one public HTTPS address that can receive POST. Services such as Zapier or n8n that provide a webhook URL also work as long as they meet the rules above.
Can I register a local development URL (localhost)? No. Use a public domain name, for example through a tunnel that gives you a public HTTPS URL.
Can I choose only some events? Yes, per endpoint. You can also register several endpoints with different events.
What happens if my plan drops below Pro? See Webhooks, API and plans.
Does anything change in my shop? No. Webhooks only read and notify; they do not change orders, products, or stock.