@checkoutkit/webhooks

Order lifecycle events, merchant → agent platform.

pnpm add @checkoutkit/webhooks

Receiving

import { createWebhookReceiver } from "@checkoutkit/webhooks";

export const receiver = createWebhookReceiver({
  verify: { keys: [process.env.WEBHOOK_SECRET!] },
  onEvent: async (event) => {
    if (event.type === "order_create") await recordOrder(event.data);
  },
});

Verification runs against the raw body — parsing and re-serialising changes key order and breaks the signature.

Sending

import { deliverEvent } from "@checkoutkit/webhooks";

await deliverEvent(event, {
  url: agentEndpoint,
  secret: process.env.WEBHOOK_SECRET!,
  onDeadLetter: (event, failure) => queueForReplay(event, failure),
});

Retries 5xx/408/429 with backoff and re-signs each attempt so the timestamp stays inside the receiver's replay window. 4xx is not retried — the receiver rejected the payload, and repeating it produces the same rejection.

CheckoutKit is an independent community implementation of the Agentic Commerce Protocol. It is not affiliated with, sponsored by, or endorsed by OpenAI or Stripe.

Part of CheckoutKit · Apache-2.0