Hear about changes within a minute instead of checking for them.
On the manage page, add up to five https addresses and choose what to hear about. Within about a minute of a change, anySKU POSTs a short notice. It only says what changed; read the details with your key. We compare against what we saw about a minute earlier, so something undone within that minute, like a seller who joins and leaves straight away, sends nothing.
{ "id": "6f1c...", "type": "order.collected", "createdAt": "2026-10-04T15:02:11Z",
"collective": "your-group", "data": { "eventId": "...", "orderNumber": "SO-10442", "seller": "maplecrafts" } }
Types: event.affiliated, event.started, event.ended, event.unlinked, seller.joined, seller.left, order.placed, order.collected, order.cancelled, order.refunded, share.paid, and webhook.test (the Send test button).
Check every notice is really from anySKU
Each one carries AnySku-Signature: t=1696431731,v1=5f2b.... Compute HMAC-SHA256 with your endpoint's signing secret (whsec_…, shown once when you add it) over t + "." + the raw body, compare with v1 in constant time, and reject anything with a t more than five minutes old.
// Node.js
const crypto = require('crypto');
function isFromAnySku(rawBody, header, secret) {
const parts = Object.fromEntries(header.split(',').map(p => p.split('=')));
if (Math.abs(Date.now() / 1000 - Number(parts.t)) > 300) return false;
const expected = crypto.createHmac('sha256', secret).update(`${parts.t}.${rawBody}`).digest('hex');
return crypto.timingSafeEqual(Buffer.from(expected), Buffer.from(parts.v1));
}
Answer with any 2xx quickly. Otherwise we retry after 1 minute, 5 minutes, 30 minutes, 2, 6, 12 and 24 hours, sending the same id each time (use it to ignore repeats). After 50 failures in a row the address is switched off until an administrator turns it back on. Redirects aren't followed, and addresses must be on the public internet.