Connecting your shop platform

Your shop sends every order to one signed HTTPS endpoint; we answer at once and send the review invitation later.

Before you start

Ask us for your store id and webhook secret through the contact form. Keep the secret on your server only.

The request

POST https://sooqly.ae/api/v1/stores/{storeId}/order-webhook
Content-Type: application/json
X-Sooqly-Timestamp: <unix time in seconds or milliseconds>
X-Sooqly-Signature: sha256=<hex HMAC-SHA256 of "<timestamp>.<raw body>">

• The signature is the HMAC-SHA256 of the timestamp, a full stop and the raw request body, keyed with your webhook secret, written as lower-case hex after sha256=.
• The timestamp must be within 300 seconds of our clock.
• Sign the exact bytes you send. Re-serialising the JSON after signing breaks the signature.

The body

The order reference can be up to 200 characters, and we keep up to 50 product ids.

A signed example

With the secret whsec_test_example and the timestamp 1790157600:

X-Sooqly-Timestamp: 1790157600
X-Sooqly-Signature: sha256=e13f51d755db2ee63a920bd2438336bfebea96f31f4fdc02deb9fd9ca069fbf3

{"orderRef":"SO-2026-104233","email":"buyer@example.com","productIds":["3f0c9a52-7d1e-4f6b-9b61-2f1d7c4e8a10"],"orderedAt":"2026-09-18T14:05:00+04:00","locale":"en"}

The same signature in Node.js:

import { createHmac } from 'node:crypto';

const body = JSON.stringify(order); // send exactly this string
const timestamp = String(Math.floor(Date.now() / 1000));
const signature =
  'sha256=' + createHmac('sha256', secret).update(`${timestamp}.${body}`).digest('hex');

The response

Errors use one format: {"code", "message", "details"}.