Developers | Shoppingate

Server side

Webhooks — events you build a receiver for

Every state change on a mini-app order is delivered as an outbound POST to a URL you register in the developer portal. Payload is JSON, signed with an HMAC-SHA256 over the raw body using your webhook secret.

Retries: 8 attempts with exponential backoff over ~24 hours before the delivery drops to a dead-letter queue you can inspect in the portal.

order.created

Order accepted by Shoppingate.

order.paid

Payment captured.

order.processing

Vendor accepted, work begun.

order.completed

Fulfilled end-to-end.

order.cancelled

User or vendor cancelled. When a vendor cancels a paid/processing order, this fires immediately and the platform then issues a full auto-refund — expect a separate order.refunded event when the gateway settles.

order.refunded

Full refund settled by the gateway. For vendor cancels of paid orders, fires after order.cancelled (async — seconds for wallet/Tamara, up to a few days for card).

order.partially_refunded

Partial refund processed.

mini_app.sg_suspended

Platform suspended the mini app.

mini_app.sg_restored

Suspension lifted.

Verifying the signature

// Every request carries X-SG-Signature = sha256=<hex-hmac>
// Compare it against HMAC-SHA256(rawBody, webhookSecret).

const crypto = require('crypto');

function verify(rawBody, headerSig, secret) {
  const expected = 'sha256=' + crypto
    .createHmac('sha256', secret)
    .update(rawBody)
    .digest('hex');
  return crypto.timingSafeEqual(
    Buffer.from(expected),
    Buffer.from(headerSig)
  );
}

Return 2xx fast. The dispatcher waits 15 seconds for a response — do the heavy work in your own background queue after acknowledging. Non-2xx or timeout counts as a failure and enters the retry sequence.