Integrations and webhooks

API keys, signatures, retries and idempotency.

API keys

Sandbox keys start with sk_test_. The full key is shown once. Rotation keeps the old key for 24 hours; revocation is immediate.

Verifying webhooks

Orion-Signature: t=1760000000,v1=<hex HMAC-SHA256(secret, "<t>.<raw body>")>
  1. Compute the HMAC over the timestamp, a period, and the raw request body.
  2. Compare in constant time.
  3. Reject timestamps more than 5 minutes old.
  4. De-duplicate by the event id.

Retries

Non-2xx responses are retried with exponential backoff, up to 8 attempts. Manual retries resend the same event ID.

Store integrations

Custom API and payment links work in the sandbox. WooCommerce and Shopify are planned.