Webhook (HTTP notifications)

Kash.click supports two families of webhooks: legacy webhooks, preserved for backward compatibility, and new generation JSON webhooks intended for integrations with Zapier, Make, n8n, Pipedream or your own services.

Next-generation JSON webhooks

Each delivery is sent via POST with a stable JSON body and signature headers. Unnecessary sensitive data is not exposed in customer, product, and checkout closing objects.

Common JSON envelope

{ "id": "evt_6e6f9d9e7c7c4d71b97c2f51", "type": "sale.created", "created_at": "2026-07-16T10:00:00Z", "account_id": 123, "data": {  "sale": {   "id": 98765,   "number": 42,   "total": 59.9,   "paid": 59.9,   "is_refund": false,   "cashbox_id": 7,   "delivery_method": "Counter sale"  },  "customer": {   "id": 456,   "name": "Martin",   "surname": "Julie",   "email": "julie@example.com"  },  "items": [],  "payments": [],  "invoice": {   "id": 98765,   "number": 42,   "pdf_url": "https://php7.enregistreuse.fr/workers/webpages/downloadInvoice.php?idcommande=98765&verif=..."  } }}

Headers sent

Signature verification

The signature is calculated using the shared secret of the webhook, on the timestamp, a dot, then the raw JSON body exactly received.

expected = "v1=" + hex_hmac_sha256(X-Kash-Timestamp + "." + raw_body, webhook_secret)

$timestamp = $_SERVER["HTTP_X_KASH_TIMESTAMP"];$signature = $_SERVER["HTTP_X_KASH_SIGNATURE"];$body = file_get_contents("php://input");$expected = "v1=".hash_hmac("sha256", $timestamp.".".$body, $secret);if (!hash_equals($expected, $signature)) {  http_response_code(401);  exit;}if (abs(time() - intval($timestamp)) > 300) {  http_response_code(401);  exit;}

Types of events available

Details of data objects

Reliability and retries

• An HTTP 2xx response marks the delivery as successful.
• Other responses or network errors remain pending until the next attempt.
• The retry intervals are 1 minute, 5 minutes, 15 minutes, 1 hour, then 6 hours.
• After 5 attempts, the delivery status changes to failed.
• Each attempt stores the date, HTTP code, a response snippet, and the error message.

Historical Webhooks

The old saleWebhookURL and openingWebhookURL fields are still supported. They submit application/x-www-form-urlencoded forms and do not replace the new generation JSON webhooks.

historical command webhook

The URL configured for sales is called when an order is validated or completed.

• type : validated or terminated
• isRefund : true/false if refund
• orderID : order accounting number
• orderInternalID : internal order identifier
• creationDate, validationDate, valueDate : dates in timestamp
• price, paid : order amounts
• clientID, client : client identifier and JSON
• cashBoxID, deliveryMethod : checkout and delivery
• PDFinvoice : PDF invoice link
• items, VATs, VAT, payments : JSON articles, VAT and payments
• HMAC_SHA256, signatureVerificationURL : historical signature and verification URL

Historical webhook for opening/closing cash registers

The URL configured for cash register openings and closings is called when cash register state changes.

• type : cashBox_close Or cashBox_open
• total : Total cash received during the period, for cashBox_close
• opened, closed : opening and closing dates
• signatureVerificationURL : URL to verify the historical signature