Push Magento 2 events to any external system with signed, queue-based webhooks

Your store knows the moment an order lands, a shipment goes out, or stock runs low. OCMLabs Webhooks pushes that moment to any system you run - ERP, CRM, fulfillment, Slack, a custom endpoint - as a signed HTTP request with a payload you shape yourself. No polling, no middleware subscription, no custom module development.

React to store events the moment they happen

Most integrations poll Magento’s API on a schedule and hope nothing important happened in between. OCMLabs Webhooks works the other way around: subscribe a URL to an event, and the store pushes the data out in real time. Ten curated events cover the common integration points - orders, shipments, invoices, credit memos, customers, products, and stock - and a custom event option lets you subscribe to any Magento event by name.

Delivery never slows your store down. When an event fires, a lightweight observer snapshots the entity data and hands it to a Magento message queue. Nothing in the checkout or admin request path ever waits on template rendering, HTTP I/O, or a slow endpoint.

Payloads shaped exactly how your endpoint expects

Every webhook carries a Smarty-templated payload, so you send the JSON your receiving system actually wants - not a fixed blob you have to transform on the other side. Each curated event prefills the form with a sensible default template you can use as-is or edit freely.

The form includes a live “Available Template Variables” reference: one click loads the real, current variable set for the event you’ve selected, pulled from actual store data so it can never go out of date. A synchronous “Send Test” button delivers a sample payload to your endpoint before you commit.

Deliveries you can trust - and prove

Delivery is at-least-once. Failed attempts are rescheduled automatically with exponential backoff, and every attempt of a delivery shares an idempotency UUID sent as X-Webhook-Delivery-Id so your receiver can safely dedupe.

Every attempt is logged: event, attempt number, status, HTTP code, duration, the exact request body sent (when payload logging is enabled), and the response body that came back. When an endpoint misbehaves, you diagnose it from the admin instead of guessing.

Secure by default

Configure a secret on any webhook and every delivery is signed with an X-Webhook-Signature HMAC-SHA256 header computed over the exact bytes on the wire. Bearer and Basic authentication are supported per webhook, credentials are encrypted at rest, destination URLs pass an SSRF guard, and admin-authored templates run in a locked-down Smarty sandbox.

At a glance

MODULE

OCMLabs_Webhook (Composer: ocmlabs/module-webhook)

MAGENTO

2.4.7 - 2.4.8, Open Source and Adobe Commerce

PHP

8.2, 8.3, or 8.4

EVENTS

10 curated events plus custom event subscriptions by name

DELIVERY

Queue-based, at-least-once, exponential-backoff retries, full delivery log

SECURITY

HMAC-SHA256 signing, encrypted credentials, SSRF guard, sandboxed templates

ADMIN

ACL-controlled access (OCMLabs_Webhook::manage, ::log, ::config)