Webhooks
What events fire, how deliveries are signed, and when they are retried.
When a product or order changes, Pengine sends a signed POST request to your endpoint. The payload
contains the event topic and resource ID. Fetch the resource from the API before acting on the change.
{
"id": "bi4brwu1ggngm9oc5jjieait",
"storeId": "ovy3u54frpsl4sd963aja0h1",
"topic": "orders_update",
"data": { "id": "p948dnb4qbo2d86i2mx67svp" },
"isTest": false,
"createdAt": "2026-08-19T12:41:07.514Z"
}IDs, not state
A payload contains the product or order ID, not the resource state. Fetching the resource ensures that delayed or out-of-order deliveries cannot overwrite newer data.
The events
There are five, covering products and orders:
products_create products_update products_delete
orders_create orders_updateRegister only what you use. A topic with no URL registered is never queued and never sent. See Events for when each one fires, the payload, and what to do with it.
Setting one up
Build an endpoint
Create a public HTTPS endpoint that accepts a JSON POST request. Pengine rejects plain HTTP and URLs
that resolve to private or loopback addresses. Use a tunnel for local development.
Verify the signature
Every delivery carries X-Pengine-Signature. Check it before you trust the body, and reject anything
that does not match. See Verifying signatures.
Answer quickly, work afterwards
Return 2xx within ten seconds after storing the event. Other status codes and slower responses count
as failed deliveries. Process the event asynchronously.
Register the URL
In the Pengine app, open your store's API settings and set a URL per topic you want. One URL per topic, and topics you do not register are never sent.
Send a test
Send a test event from the app. Test events use the standard signature and set isTest to true, but
Pengine does not retry them.
Handling deliveries
Deduplicate on id. The event ID remains stable across retries. Store processed IDs and ignore
duplicates.
Do not rely on delivery order. Retries and parallel deliveries can deliver an older event after a newer one. Refetch the resource to get its current state.
Use storeId to select the API key. It identifies the store, the corresponding key, and the ID to
use when fetching the resource.
Watch isTest. Test deliveries should not create real work in your system.
When something goes wrong
Pengine logs each delivery attempt for 14 days. The log includes the URL, attempt number, status code, duration, and first kilobyte of the response body. Find it in the store's API settings when diagnosing missing events.