How to connect WooCommerce to external apps with webhooks
WooCommerce includes webhooks, so you can connect an external app without installing a plugin: create a delivery endpoint, choose an event, add a secret, and test the response. Use a webhook plugin when you need no-code rules, several endpoints, or easier logging.
- 01Prepare the receiving app
- 02Choose the event to send
- 03Create the WooCommerce webhook
- 04Verify the request securely
- 05Send a real test order
- 06Fix failures before going live
What you need
- A WooCommerce store with administrator access
- An external app or webhook receiver that accepts HTTPS POST requests
- The event you want to send, such as a new order
- A shared secret supplied to both WooCommerce and the receiving app
Prepare the receiving app
First, create or find the external app's webhook endpoint. It must accept an HTTP POST request over HTTPS and return a successful 2xx response after it receives the data. Many automation services provide this URL when you create a webhook trigger.
Check what the app expects before configuring WooCommerce: JSON content, required fields, authentication, and whether it can verify an HMAC signature. Do not paste a private admin URL or a page that only accepts browser form submissions.
Choose the event to send
Decide exactly what should trigger the connection. WooCommerce's built-in topics include created, updated, and deleted events for orders, products, customers, and coupons. You can also use an action event for a specific WooCommerce or extension action, such as woocommerce_add_to_cart.
Start with one event and one endpoint. Sending every order update when the external app only needs new orders creates duplicate work and makes troubleshooting harder.
Create the WooCommerce webhook
In WordPress, go to WooCommerce > Settings > Advanced > Webhooks and select Add webhook. Give it a recognisable name, set the status to Active, choose the topic, paste the external app's delivery URL, and enter the shared secret. Then save the webhook.
WooCommerce sends a ping to the delivery URL when an active webhook is saved for the first time. If the app reports that it received a test request, that confirms the URL is reachable, not necessarily that the live payload is mapped correctly.
Verify the request securely
Keep the same secret in both systems and make the receiving app verify WooCommerce's X-WC-Webhook-Signature header against the raw request body. WooCommerce generates a base64-encoded HMAC-SHA256 signature and also sends headers identifying the source, topic, resource, event, webhook ID, and delivery ID.
Do not verify a signature after parsing and re-encoding the JSON, because even harmless formatting changes can produce a different signature. Reject requests with a missing or invalid signature, and avoid putting the secret in the delivery URL.
Send a real test order
Trigger the selected event with a test order or another controlled store change. Check that the external app receives JSON with the fields it needs, processes it once, and returns a successful response quickly. If the app needs more time, have it acknowledge the webhook first and process the work separately.
Then open WooCommerce > Status > Logs, filter for webhooks-delivery, and inspect the request and response. WooCommerce records delivery details so you can see the HTTP status and returned body.
Fix failures before going live
The usual failure is an endpoint returning a 4xx or 5xx response because the URL is wrong, authentication is missing, the payload is not what the app expects, or a firewall blocks the request. WooCommerce processes delivery in the background by default, so a successful checkout does not prove that the external app has completed its work.
WooCommerce disables a webhook after more than five consecutive delivery failures. Check the delivery log, correct the receiving app or endpoint, and edit the webhook to enable it again. If you need several triggers, endpoints, or no-code routing, ShopMagic Webhooks is the fast way to manage those connections with configurable triggers and logging.
Let ShopMagic Webhooks do it
No-code event triggers, multiple endpoints, and logging for WooCommerce integrations; choose it for flexible webhook-based data transfers.
Sources
- developer.woocommerce.com /docs/apis/rest-api/v2/webhooks
- woocommerce.com /document/webhooks/
Questions
- Do I need a plugin to connect WooCommerce to an external app with webhooks?
- No, you do not need a plugin for a basic connection because WooCommerce includes webhooks in its core settings. Go to WooCommerce > Settings > Advanced > Webhooks and send a selected event to an HTTPS endpoint. A plugin becomes useful when you need no-code conditions, multiple destinations, custom routing, or a simpler activity log.
- What does the WooCommerce webhook secret do?
- The secret lets the receiving app verify that the request came from your WooCommerce store. WooCommerce uses it to create an HMAC-SHA256 signature of the request body and sends that signature in the X-WC-Webhook-Signature header. Keep the secret private and have the receiver validate the raw body before accepting the event.
- Why did WooCommerce disable my webhook?
- WooCommerce disables a webhook after more than five consecutive delivery failures. Common causes include an incorrect delivery URL, a blocked outbound request, an authentication error, a signature mismatch, or an endpoint returning a 4xx or 5xx response. Review the webhooks-delivery log, fix the receiver, and reactivate the webhook.
- Can one WooCommerce event send data to several apps?
- Yes, create a separate webhook for each destination, using the same or different topics as needed. Give each webhook its own name and secret so you can revoke or troubleshoot one connection without affecting the others. If managing many destinations becomes repetitive, a webhook plugin can provide a single interface for endpoints, triggers, and logs.