Wix Webhooks

When to Use This Skill

• How do I receive Wix webhooks in a self-hosted app?
• How do I verify Wix webhook signatures (the JWT)?
• Where do I get my Wix public key to verify webhooks?
• How do I handle wix.ecom.v1.order_created / order_approved / order_canceled events?
• Why is my Wix webhook JWT verification failing?

How Wix Webhooks Work

Wix delivers each webhook as an HTTP POST whose entire request body is a signed JWT (RS256), signed by Wix. There are no X-Wix-Signature/HMAC headers and it is not Standard Webhooks — verification means validating the JWT with your app's public key.

• Get your public key from the app dashboard → Custom Apps → your app → Webhooks → "Get Public Key" (also under View ID & keys). It is per-app; there is no global JWKS endpoint.
• Verify against the raw, unparsed body. Re-serializing the JSON breaks the signature.
• The decoded JWT is a nested envelope: outer { data, iat, exp } → data is a JSON string → parse it to { eventType, instanceId, data } → parse the inner data string to get the entity/event payload.

Verification (core)