Webhooks

An ORQO automation with the Webhook Received trigger gets its own URL. POST JSON to it from your backend (a new order, a failed payment, a booking) and the automation runs: send a WhatsApp template, tag the contact, assign a conversation, and so on.

1. Create the triggerCopy Anchor Link

In ORQO open Automations, create an automation, pick the Webhook Received trigger and choose Generate token. Copy two values from the trigger panel:

• the Webhook URL, https://app.orqo.site/webhooks/automation/{trigger_token}
• the Signing secret. It is shown right after generating; keep it on your server, like an API token.

Regenerate token issues a new URL and secret; the old ones stop working. Activate the automation: requests to an inactive automation are refused.

2. Sign and send the requestCopy Anchor Link

Every request must carry two headers:

Sign the exact bytes you send: serialize the JSON once and send that string.

import crypto from 'node:crypto';

const body = JSON.stringify({ event: 'order.paid', phone: '+201001234567', order_id: 'A-1042', total: '450.00' });
const timestamp = Math.floor(Date.now() / 1000).toString();
const signature = crypto.createHmac('sha256', process.env.ORQO_TRIGGER_SECRET)
  .update(`${timestamp}.${body}`)
  .digest('hex');

await fetch(process.env.ORQO_TRIGGER_URL, {
  method: 'POST',
  headers: {
    'Content-Type': 'application/json',
    'X-Orqo-Timestamp': timestamp,
    'X-Orqo-Signature': `sha256=${signature}`,
    'Idempotency-Key': 'order-A-1042-paid',
  },
  body,
});

3. The payloadCopy Anchor Link

Any JSON object. Its fields are available to the automation's steps as variables. Two fields are special:

ResponsesCopy Anchor Link

Retry on network errors and 5xx with the same body and Idempotency-Key, re-signing with a fresh timestamp. Don't retry a 404: check the URL, the secret and your clock.