Wix Webhooks

When to Use This Skill

• How do I receive Wix webhooks in a self-hosted app?
• How do I verify Wix webhook signatures (the JWT)?
• Where do I get my Wix public key to verify webhooks?
• How do I handle wix.ecom.v1.order_created / order_approved / order_canceled events?
• Why is my Wix webhook JWT verification failing?

How Wix Webhooks Work

Wix delivers each webhook as an HTTP POST whose entire request body is a signed JWT (RS256), signed by Wix. There are no X-Wix-Signature/HMAC headers and it is not Standard Webhooks — verification means validating the JWT with your app's public key.

• Get your public key from the app dashboard → Custom Apps → your app → Webhooks → "Get Public Key" (also under View ID & keys). It is per-app; there is no global JWKS endpoint.
• Verify against the raw, unparsed body. Re-serializing the JSON breaks the signature.
• The decoded JWT is a nested envelope: outer { data, iat, exp } → data is a JSON string → parse it to { eventType, instanceId, data } → parse the inner data string to get { id, entityFqdn, slug, entityId, eventTime, createdEvent | updatedEvent | deletedEvent | actionEvent }.
• The two layers name the event differently. The dotted string wix.ecom.v1.order_created lives on the middle envelope as eventType. The inner payload has no eventType — it names the same event as the pair entityFqdn: "wix.ecom.v1.order" + slug: "created". Wix's own reference pages show the inner form, so match on eventType at the middle layer (or let the SDK dispatch), not on a dotted string inside the inner payload.