Skip to main content
Webhooks are durable HTTP delivery for backend receivers. They are not a live WebSocket stream. Use webhooks when an integration needs signed ProductEvent delivery with delivery logs and replay. Use realtime instead when an online client needs live events while connected. Webhook signing secrets are for verifying inbound events from Ando. They are not API keys. Use an API key only when you create, update, test, or replay webhook endpoints through the API or CLI. See Which key do I use? for the credential model. Use these references for exact webhook endpoint, delivery, and event schemas: Webhook receivers must verify the raw request body with Ando-Signature, persist or enqueue the event quickly, return a 2xx response, and deduplicate business side effects by the stable event id (the Ando-Event-Id header, which matches the payload id).