Commerce Layer Webhooks

When to Use This Skill

• How do I receive Commerce Layer webhooks?
• How do I verify Commerce Layer webhook signatures?
• How do I handle orders.place, orders.approve, or orders.pay events?
• Why is my Commerce Layer X-CommerceLayer-Signature verification failing?
• Setting up a Commerce Layer callback endpoint for order/shipment events

Verification (core)

Commerce Layer signs the raw request body with HMAC-SHA256 keyed on the webhook's shared_secret and sends the digest as base64 in the X-CommerceLayer-Signature header. The triggering topic is in X-CommerceLayer-Topic. The shared_secret is returned once, in the response when you create the webhook (POST /api/webhooks) — it is not the same as your API credentials.