Skip to main content
WEBHOOK
klikitOrderCreated
{
  "brand_id": 663,
  "branch_id": 1062,
  "orders": [
    {
      "id": 7585307,
      "external_id": "ABC-123",
      "business_id": 737,
      "brands": [
        {
          "id": 663,
          "title": "Bali Bites"
        }
      ],
      "branch_id": 1062,
      "status": 2,
      "cart": [
        "..."
      ],
      "payment_status": 1,
      "payment_channel": 8,
      "payment_method": 14
    }
  ]
}

Authorizations

​
Authorization
string
header
required

Authorization: Basic base64(partner_key:secret_key).

Credentials are issued by a klikit operator. The plaintext secret_key is shown once at issuance and cannot be retrieved later — store it securely. If lost, ask your operator to rotate the secret to receive a new one. The old secret stops working immediately on rotation; there is no overlap window.

Headers

​
x-klikit-signature
string
required

HMAC-SHA256 over the raw request body using your webhook_secret_key, hex-encoded.

Verify exactly like this on your side (Go example, same shape in any language):

h := hmac.New(sha256.New, []byte(secret))
h.Write(rawBody)
expected := hex.EncodeToString(h.Sum(nil))
if !hmac.Equal([]byte(expected), []byte(r.Header.Get("x-klikit-signature"))) {
    http.Error(w, "forbidden", http.StatusForbidden)
    return
}

Two things that trip people up:

  • Use the raw body, not a re-marshalled struct. Decoded → re-encoded JSON has different byte order / whitespace and will fail verification. Read the body bytes first, verify, then unmarshal.
  • The webhook_secret_key is issued during partner onboarding by your klikit operator. It's a per-partner secret stored alongside your vendor record — not the same as your partner API secret_key.
​
x-klikit-event-id
string

Stable per-delivery id. Use it to de-dupe replays.

Body

application/json

Body that klikit POSTs to your registered webhook URL for the three order events (klikit.order.created.v2, klikit.order.status.updated, klikit.order.cart.updated).

Same envelope shape for all three; the orders array carries full order records (same shape as getOrder returns).

Envelope klikit POSTs to your webhook URL for all three order events. The orders array is the same order record shape returned by getOrder — including payment.status, payment.method, payment.channel, cart[], and the OrderStatus numeric code.

​
brand_id
integer
required

Brand id the order belongs to. Use this together with branch_id to route the event inside your system.

​
branch_id
integer
required

Branch id the order belongs to.

​
orders
object[]
required

One or more order records. Most deliveries carry a single order; batches happen when multiple orders land in the same hookit tick.

Response

Acknowledged