Webhooks

Mit Webhooks kannst du externe Systeme in Echtzeit über Ereignisse in Fynn benachrichtigen lassen. Webhooks werden per POST-Request an deine hinterlegte URL gesendet und enthalten strukturierte JSON-Daten zum jeweiligen Ereignis.

Webhooks lassen sich unter Einstellungen → Webhooks konfigurieren.

​

Sicherheit: X-Webhook-Signature

Jede Webhook-Anfrage enthält einen Header X-Webhook-Signature, der wie folgt generiert wird:

hash_hmac('sha256', $body, $webhookSecret)

• $body: Der ungeänderte JSON Body der Webhook-Anfrage (als String)
• $webhookSecret: Dein geheimer Schlüssel für diesen Webhook

Den Secret findest du unter: Einstellungen → Webhooks → Details

​

Beispiele

$webhookSecret = 'dein_webhook_secret';
$body = file_get_contents('php://input');
$signature = $_SERVER['HTTP_X_WEBHOOK_SIGNATURE'] ?? '';

$expectedSignature = hash_hmac('sha256', $body, $webhookSecret);

if (!hash_equals($expectedSignature, $signature)) {
    http_response_code(401);
    exit('Invalid signature');
}

// Verarbeitung ...
http_response_code(200);
echo 'OK';

$webhookSecret = 'dein_webhook_secret';
$body = file_get_contents('php://input');
$signature = $_SERVER['HTTP_X_WEBHOOK_SIGNATURE'] ?? '';

$expectedSignature = hash_hmac('sha256', $body, $webhookSecret);

if (!hash_equals($expectedSignature, $signature)) {
    http_response_code(401);
    exit('Invalid signature');
}

// Verarbeitung ...
http_response_code(200);
echo 'OK';

using System.Security.Cryptography;
using System.Text;

string body = await new StreamReader(Request.Body).ReadToEndAsync();
string signature = Request.Headers["X-Webhook-Signature"];
string secret = "dein_webhook_secret";

using (var hmac = new HMACSHA256(Encoding.UTF8.GetBytes(secret)))
{
    var hash = hmac.ComputeHash(Encoding.UTF8.GetBytes(body));
    var expected = BitConverter.ToString(hash).Replace("-", "").ToLower();

    if (expected != signature)
    {
        return Results.Unauthorized();
    }
}

// Verarbeitung ...
return Results.Ok();

    const crypto = require('crypto');
    const express = require('express');
    const app = express();

    app.use(express.text({ type: 'application/json' }));

    app.post('/webhook', (req, res) => {
        const webhookSecret = 'dein_webhook_secret';
        const signature = req.headers['x-webhook-signature'];
        const expected = crypto
        .createHmac('sha256', webhookSecret)
        .update(req.body)
        .digest('hex');

        if (signature !== expected) {
            return res.status(401).send('Invalid signature');
        }

        // Verarbeitung ...
        res.send('OK');
    });

​

Unterstützte Events

​

Produkt

• product.created
• product.updated
• product.deleted
• product.archived

​

Rabattcodes

• coupon.created
• coupon.updated
• coupon.deleted
• coupon.toggled

​

Kunden

• customer.created
• customer.updated
• customer.archived
• customer.unarchived
• customer.deleted

​

Rechnungen

• invoice.created
• invoice.finalized
• invoice.credited
• invoice.updated
• invoice.refunded
• invoice.canceled
• invoice.paid
• invoice.closed
• invoice.unpaid
• invoice.remindered
• invoice.requires_approval
• invoice.payment_method.updated

​

Preispläne

• price_plan.archived

​

Abonnements

• subscription.activated
• subscription.billed
• subscription.created
• subscription.changed
• subscription.invoice_address.updated
• subscription.delivery_address.updated
• subscription.payment_method.updated
• subscription.item.instant_metered
• subscription.item.metered
• subscription.item.quantity_changed
• subscription.products.ordered
• subscription.trial_expired
• subscription.trial_extended
• subscription.updated
• subscription.paused
• subscription.resumed
• subscription.canceled
• subscription.cancellation_revoked
• subscription.terminated
• subscription_item.terminated

​

Mahnwesen

• dunning_document.created
• dunning_document.paid
• dunning_document.canceled

​

Warenkorb

• cart.completed
• cart.paid

​

Features & Entitlements

• feature.created
• feature.activated
• feature.archived
• entitlement.state.updated

​

Hinweise

Die Events werden bei einem Fehler bis zu 3x wiederholt.