One generic door, deliberately
Rather than half-supporting a dozen platforms, there is one well-documented webhook endpoint that behaves identically to the native integrations. Everything downstream — order updates, COD confirmation, the AI order lookup, customer sync — works exactly the same way once your events arrive.
Connect first, then send us events
Click connect and we immediately generate a private webhook URL and a signing secret unique to your store. Nothing else is required from you up front — the credentials form is empty because there is nothing for us to log into.
- Click Connect — you get a private webhook URL and a signing secret
- POST our JSON to that URL when an order is placed, paid, shipped, delivered or cancelled
- Sign each request with an HMAC-SHA256 header
- The complete example, with your real URL and secret, is shown after you connect
Every request is verified
Add an X-Xilot-Signature header containing sha256= followed by the HMAC-SHA256 of the exact request body, keyed with your signing secret. Unsigned or tampered requests are rejected, and a replayed event is recognised and ignored rather than messaging your customer twice.
- Unsigned requests are rejected with 401
- Tampered bodies fail verification
- Duplicate events are recognised and skipped
X-Xilot-Signature: sha256=<HMAC-SHA256 of the raw body, keyed with your secret>
Compute it over the exact bytes you send — not a re-serialised copy.
Worked examples in shell and PHP are shown in the app after you connect.
Identical to a native integration
Once events are arriving, nothing about the experience differs from a WooCommerce or Shopify store.
- Order confirmed, paid, shipped, delivered and cancelled updates — with the courier and tracking link
- Cash-on-delivery confirmation with Confirm / Cancel buttons before you ship
- Every buyer synced into your phonebook with spend, order count and automatic tags
- Your AI able to answer “where is my order?” with real, live data (Pro)
OpenCart, Magento and PrestaShop
None of these send the webhooks we need out of the box, so they need a small extension, module, or a few lines added by whoever maintains your site. It is genuinely a small job — one HTTP POST with a signature header, fired on order status change. Purpose-built extensions for OpenCart and Magento are on the roadmap rather than shipped, and we would rather say so than imply a one-click install exists.
- OpenCart — needs an ocmod or a small code change today
- Magento — needs a module or an observer today
- PrestaShop and custom builds — any hook that can POST will do
Store integrations are part of the Growth plan. Cart recovery, AI store lookups and multiple stores are part of Pro.
See plans