Verify and process virtual try-on webhooks
Webhooks notify a merchant backend when an asynchronous job reaches a terminal state. The endpoint must use HTTPS, verify the TryRobe signature before trusting the body, return quickly, and handle duplicate delivery safely.
Signature verification
Read X-Tryrobe-Timestamp and X-Tryrobe-Signature. Compute a lowercase hex HMAC-SHA256 over timestamp + '.' + the exact raw request body using the endpoint secret, then compare signatures with a timing-safe function. Reject stale timestamps according to your risk policy and never verify a parsed and re-serialized body.
Idempotent event handling
Persist X-Tryrobe-Event-Id before applying business effects. Repeated delivery of the same event ID must not create multiple customer notifications or duplicate state transitions.
Delivery behavior
Return a 2xx response promptly after durable acceptance. TryRobe attempts delivery immediately and retries temporary failures with bounded backoff, up to five total attempts. Queue slower merchant work and retain authenticated job polling because webhooks can still be delayed or exhaust retries.
Frequently asked questions
Should webhook order be assumed?
No. Process events by authoritative job state and make handlers safe for duplicates and delayed delivery.
Is the webhook secret the license key?
No. The webhook signing secret is a separate secret created for the endpoint and must be stored independently.