Setting Up Vendor Webhooks (Team & Enterprise)

Send real-time event notifications — new orders, refunds, session closes, hardware order status, and team changes — to your own server or automation tool as they happen in Membrzs.

1. What Webhooks Are For

A webhook is a URL on your own server (or a tool like Zapier, Make, or a custom integration) that Membrzs sends a POST request to every time something happens on your account. Use it to sync orders into your own accounting system, trigger custom notifications, or feed sales data into another app — without having to poll the Membrzs API.

Webhooks are available on Team and Enterprise plans.

2. Adding a Webhook Endpoint

  1. In the Web Portal, go to Settings > Webhooks.
  2. Enter the URL that should receive the events (must be a valid http:// or https:// address reachable from the internet).
  3. Check the boxes for the events you want to subscribe to (see the full list below). You can select events from multiple groups on the same endpoint.
  4. Click Add Endpoint.

Right after creating an endpoint, Membrzs shows you a signing secret one time only — copy it immediately. You'll need it to verify incoming requests (see below). If you lose it, you can generate a new one at any time with Rotate secret, but the old one stops working the moment you do.

You can add more than one endpoint if you want to send different events to different places.

3. Available Events

Group Events
Orders Order created, Order voided, Order refunded
Sessions Session opened, Session closed, Session reconciliation complete
Hardware Hardware order shipped, delivered, cancelled, returned
Team Team member added, Team member removed

Each endpoint only receives the events it's checked — an endpoint subscribed only to order.refunded, for example, won't receive order.created events.

4. Verifying Webhook Signatures

Every request Membrzs sends includes an X-Membrzs-Signature header, formatted as sha256=<hex digest>. It's an HMAC-SHA256 signature of the raw request body, signed with your endpoint's signing secret. Your server should recompute the same HMAC over the exact bytes it received and compare it to the header before trusting the payload — this confirms the request actually came from Membrzs and wasn't tampered with in transit.

The request body is JSON with this shape:

{
  "id": "unique event id",
  "type": "order.created",
  "created": 1735689600,
  "vendor_id": "your vendor id",
  "data": { }
}

Membrzs delivers events "at least once" — treat the id field as an idempotency key on your end in case the same event is ever delivered more than once (for example, after a retry).

5. Delivery History, Details & Retrying Failed Deliveries

Click the ▼ on any endpoint to expand its Recent Deliveries log, showing the most recent 50 attempts with their event type, an OK/Fail status badge, the HTTP status code your server returned, and when each was sent.

Click Details on any delivery to see the exact JSON payload that was sent and the raw response body your server returned — useful for debugging why an endpoint is rejecting requests.

If a delivery failed, a Retry button appears next to it. Retrying re-sends the exact same payload (same event ID and content) to your endpoint, signed with your endpoint's current secret. The retry attempt shows up as its own row in the log, marked "retry," so you can see both the original failure and the retry outcome side by side — nothing is overwritten.

Membrzs does not automatically retry failed deliveries on a schedule; retrying is a manual action from this screen.

6. Rotating Your Signing Secret

If you suspect your signing secret has been exposed, click Rotate secret on that endpoint. A new secret is generated and shown once — the old secret is invalidated immediately, so update your server with the new one right away or you'll start rejecting valid deliveries. Every rotation is logged and visible in the endpoint's expanded view under Secret Rotation History, showing who rotated it and when.

7. Pausing, Resuming & Deleting an Endpoint

  • Pause an endpoint to stop deliveries temporarily without losing its configuration or delivery history — click Pause (shown as Resume while paused) on the endpoint row.
  • Test sends a single sample order.created event immediately, regardless of which events the endpoint is subscribed to — a quick way to confirm your server is reachable and your signature verification is working before going live.
  • Delete permanently removes the endpoint and its configuration.

Frequently Asked Questions

What plans include webhooks?

Team and Enterprise. Freemium, Lite, and Premium accounts don't see the Webhooks tab in Settings.

What happens if my server is down when an event fires?

The delivery is logged as failed with whatever error occurred (including a timeout). You can retry it manually from the delivery log once your server is back up — Membrzs doesn't queue or auto-retry it for you.

Can I see webhook events for a specific order or session after the fact?

Yes — the delivery log's Details view shows the full payload that was sent for every past delivery, so you can inspect exactly what data went out even if you never received or processed it originally.

Who can manage webhooks?

Any team member with Portal access to the Settings page for your account; secret rotations are attributed to whoever performed them.

Need additional help?

If you have questions, visit Membrzs Support or contact our team via the Contact page.