Snipcart Webhooks

When to Use This Skill

• How do I receive Snipcart webhooks?
• How do I verify a Snipcart webhook is authentic? (there is no signature — read below)
• What is the X-Snipcart-RequestToken header and how do I validate it?
• Why does https://app.snipcart.com/api/requestvalidation/{token} return 404 or 401?
• How do I handle order.completed or v3/subscription.invoice.payment.succeeded?
• How do I implement the shippingrates.fetch / taxes.calculate webhooks?

Verification (core) — callback validation, NOT HMAC

Snipcart does not sign webhook payloads. There is no signature header, no HMAC, no shared webhook secret and no timestamp header. Every outbound request instead carries a random token in X-Snipcart-RequestToken, valid for one hour, which you prove genuine by calling Snipcart's API with your secret API key (HTTP Basic, key as the username, trailing colon, no password). 200 = genuine.