Order webhooks

Yusker POSTs order events to your HTTPS endpoint as they happen — the real-time signal behind kitchen screens, inventory sync and supplier dashboards.

Register an endpoint

Venue owners add webhook endpoints in the business portal under Developers. The signing secret (whsec_…) is shown once at creation — store it like a password.

Events

• order.created — a takeout or delivery order was placed.
• order.updated— an order’s state changed (paid, voided, closed).

Payload

{
  "event": "order.created",
  "event_id": "evt_9f2c41d0aa8b7e63",
  "created_at": "2026-07-05T18:21:04+00:00",
  "data": {
    "order_id": 5182,
    "venue_id": 601,
    "status": "open",
    "order_type": "takeout",
    "subtotal_cents": 2100,
    "tax_cents": 273,
    "total_cents": 2373,
    "currency": "CAD",
    "guest_label": "Sam",
    "pickup_at": "2026-07-05T18:30:00+00:00"
  }
}

Verify the signature

Every delivery carries X-Yusker-Signature: t=<unix>,v1=<hex> where v1 is HMAC-SHA256 of {t}.{raw body}using your endpoint’s secret. Verify before trusting a delivery, and use a constant-time comparison.

import crypto from "crypto";

function verify(req) {
  const sig = Object.fromEntries(
    req.headers["x-yusker-signature"].split(",").map((p) => p.split("=")),
  );
  const expected = crypto
    .createHmac("sha256", process.env.YUSKER_WEBHOOK_SECRET)
    .update(`${sig.t}.`)
    .update(req.rawBody)
    .digest("hex");
  return crypto.timingSafeEqual(Buffer.from(expected), Buffer.from(sig.v1));
}

Delivery & retries

• Respond with any 2xx quickly (do heavy work async).
• Failed deliveries retry with exponential backoff (up to 8 attempts over roughly an hour); after that the delivery is marked failed and visible in the portal.
• Deliveries can arrive more than once — key your handler on event_id (or order_id + state) so replays are no-ops.
• The event stream is a signal, not the ledger — reconcile against the orders endpoint.

Endpoint management