# Webhooks Overview

Innovorder Webhooks allow your system to stay synchronized with our platform in **real-time**. Instead of polling for changes, we push data to your configured URL whenever key events occur (e.g., a customer updates their profile or an order is paid).

###  ⚡  Real-time Sync

Synchronize your CRM, Loyalty, or ERP systems automatically as soon as data changes on Innovorder.

###  🔒  Secure & Reliable

Events are signed with HMAC-SHA256. We use an exponential backoff strategy to retry failed deliveries.

### Architecture & Reliability

-   **Event-Driven:** Notifications are sent immediately upon detection of a change.
-   **Asynchronous:** Webhook delivery does not impact the performance of the POS or ordering process.
-   **Automatic Retries:** If your server does not return a `200 OK`, we retry the delivery using an exponential backoff algorithm (1s, 2s, 4s, etc.) until 5 attempts are made.
    
    **Exception:** Retries are disabled if your endpoint returns `401 Unauthorized` or `404 Not Found`.
    
-   **Logging:** All events are logged for traceability.

### Security

To ensure the request comes from Innovorder, we include a signature header. You should verify this signature using your client secret.

| Header | Description |
| --- | --- |
| X-Innovorder-Signature | HMAC-SHA256 hash of the request body, using your client secret as the key. The value is a lowercased hexadecimal string. |

**Python Verification Example**

```python
import hmac
import hashlib

def verify_signature(client_secret, webhook_body, signature_header):
    digester = hmac.new(
        client_secret.encode('utf-8'), 
        webhook_body.encode('utf-8'), 
        hashlib.sha256
    )
    calculated_signature = digester.hexdigest()
    return hmac.compare_digest(calculated_signature, signature_header)
```

### Webhook subscriptions

Webhook subscription configuration is provisioned through Innovorder. Contact your Innovorder representative to register or change a delivery URL and the events it receives. Once provisioned, validate every delivery with the signature described above and use the event payload references below.