# CommerceHook

> CommerceHook is a hosted webhook inspector for ecommerce developers. It provides a stable HTTPS endpoint you register as your webhook destination, then shows every delivery in a visual inspector seconds after the platform sends it: the payload, the headers, the event type, the HTTP method, and the query string the delivery arrived with. Two headers are treated differently for safety: a credential header (Authorization, Cookie, Proxy-Authorization) is stored with its value replaced by [redacted], and the headers Cloudflare adds in transit (cf-*, x-forwarded-*, the sender's IP address) are not stored at all. BigCommerce, WooCommerce, Square, Shopify and Stripe have first-class support (registration from the dashboard, event labelling, replay). Anything else works generically, because an endpoint accepts any HTTP method and any body rather than POSTed JSON alone: PUT and DELETE deliveries are captured like any other, and a form-encoded or plain-text body is stored exactly as sent.

Plans: Free (1 endpoint, 24-hour event retention, no card required) and Pro at $6/month (unlimited endpoints, 90-day retention). Webhook endpoints take the form https://hooks.commercehook.app/{endpointId}. The dashboard lives at https://app.commercehook.app. The site counts page views without cookies and with no profile of any reader; the product itself is not measured at all. No advertising, no cross-site tracking.

## Docs

- [Quick start](https://commercehook.app/docs/quick-start/): from sign-up to an inspected BigCommerce webhook in about five minutes
- [Signing in](https://commercehook.app/docs/signing-in/): passkeys and emailed magic links; there are no passwords, and sessions last 7 days
- [Supported platforms](https://commercehook.app/docs/supported-platforms/): what works today and what is planned
- [Stripe](https://commercehook.app/docs/stripe/): registering Stripe webhook events with a restricted key (Webhook Endpoints write, plus Connect Accounts read so the key can name its own account), how signatures are checked, and reading payments beside the storefront's orders
- [Consume webhooks by polling](https://commercehook.app/docs/polling/): pulling captured events from the REST API on a schedule instead of receiving them, for handlers that cannot accept an inbound request
- [WooCommerce webhooks](https://commercehook.app/docs/woocommerce/): setting the integration up, in the admin or over `POST /wp-json/wc/v3/webhooks`; topics, the signing secret, the creation ping, and the three things that break it (wp-cron delivery, five consecutive failures disabling the webhook, and staging gates counting as failures)
- [FAQ](https://commercehook.app/docs/faq/): limits, retention, and privacy answers
- [API](https://commercehook.app/docs/api/): REST API for endpoints and events, authenticated with API keys ([OpenAPI spec](https://commercehook.app/openapi.json))
- [MCP server](https://commercehook.app/docs/mcp/): hosted MCP server at https://mcp.commercehook.app/mcp for AI agents; add it to claude.ai as a custom connector and sign in with OAuth (no key handling), or authenticate Claude Code and Cursor with an API key header; tools for endpoints, events, and replay
- [CLI](https://commercehook.app/docs/cli/): `npx commercehook` (npm package `commercehook`, zero dependencies). `commercehook login` signs in through the browser via OAuth (the CLI appears in Connected apps); `CH_API_KEY` covers headless machines. `listen <endpoint> --forward-to <url>` streams deliveries into a local handler: original method/headers/body, event id in `x-commercehook-replay`, at-least-once with poll-bounded lag of a few seconds, deduplication is the handler's job. Also endpoints/events/event/replay commands; every command takes `--json` and passes the API response through

## Product pages

- [Homepage](https://commercehook.app/): what CommerceHook does and how it works
- [BigCommerce](https://commercehook.app/bigcommerce/): registering BigCommerce webhooks from the dashboard, linking events back to the store, and replaying deliveries
- [WooCommerce](https://commercehook.app/woocommerce/): registering WooCommerce webhooks (core topics and custom action.* hooks) against any WordPress install, signature verification via the webhook secret, and protection from the five-failures auto-disable since CommerceHook always answers 2xx
- [Square](https://commercehook.app/square/): registering Square webhook subscriptions from the dashboard (sandbox or production), automatic signature verification since Square returns the signing key at creation, and links from each event back to the resource in the Square Dashboard or the API
- [Shopify](https://commercehook.app/shopify/): registering Shopify webhook topics from the dashboard over the GraphQL Admin API using an admin custom app, signature verification with the app secret, and links from each event straight to the record in the Shopify admin
- [Stripe](https://commercehook.app/stripe/): registering Stripe webhook events with a restricted API key, signature verification with the secret Stripe returns at creation, test and live told apart on every delivery, and payments read beside the storefront webhooks for the same basket
- [REST API](https://commercehook.app/api/): what the API makes possible, with examples
- [MCP server](https://commercehook.app/mcp/): connecting Claude, Claude Code or Cursor to your captured webhooks, by OAuth connector or API key
- [CLI](https://commercehook.app/cli/): streaming deliveries into a local handler with `listen --forward-to`, replacing the tunnel in the webhook dev loop
- [Teams](https://commercehook.app/teams/): shared endpoints, shared store credentials (BigCommerce, WooCommerce, Square, Shopify and Stripe), and per-seat pricing for agencies
- [Pricing](https://commercehook.app/pricing/): Free and Pro plan comparison
- [BigCommerce webhook inspector](https://commercehook.app/bigcommerce-webhook-inspector/): how BigCommerce webhooks work, why they fail, and how to debug them
- [WooCommerce webhook inspector](https://commercehook.app/woocommerce-webhook-inspector/): how WooCommerce webhooks behave (wp-cron delivery, the creation ping, auto-disable after five failures, the signature header) and how to debug them
- [Square webhook inspector](https://commercehook.app/square-webhook-inspector/): how Square webhooks behave (application subscriptions, the signing key returned at creation, signature over URL plus body, retries with no auto-disable, sandbox versus production) and how to debug them
- [Shopify webhook inspector](https://commercehook.app/shopify-webhook-inspector/): how Shopify webhooks behave (GraphQL-only subscriptions, base64 HMAC over the raw body with the app's client secret, deduplication by webhook id rather than event id, and the eight retries across four hours that end in the subscription being deleted) and how to debug them
- [Stripe webhook inspector](https://commercehook.app/stripe-webhook-inspector/): how Stripe webhooks behave (signature verification over the raw body, the v1 and fake v0 schemes, several valid signatures while a secret is rolling, three days of retries, at-least-once unordered delivery, and which API version shapes the payload) and how to debug them
- [Ecommerce webhook debugger](https://commercehook.app/ecommerce-webhook-debugger/): platform-agnostic webhook debugging, including what a generic endpoint captures

## Changelog

- [Changelog](https://commercehook.app/changelog/): everything shipped, newest first, filterable by area (dashboard, REST API, MCP, CLI, ingestion, teams, billing, sign-in, site); versions are CalVer (YYYY.MM.DD) because the product is deployed continuously. [Atom feed](https://commercehook.app/changelog.xml)

## Contact

- [Contact](https://commercehook.app/contact/): help requests, bug reports and feedback, or email help@commercehook.app. Signed-in users have the same form at https://app.commercehook.app/help, which attaches their plan and endpoint count.

## Policies

- [Privacy policy](https://commercehook.app/privacy/): what is stored, for how long, and where
- [Terms of service](https://commercehook.app/terms/): acceptable use, limits, and billing