Webhooks for n8n, Make and Zapier

Category: Tools  ·  Min plan: Unlimited  ·  Slug: webhooks

The Webhooks add-on pushes your store's order events to any automation tool that accepts a JSON POST over HTTPS — n8n, Make, Zapier, or your own server. Add your webhook URL once and DZBuild sends a signed notification the moment an order is created or its status changes, so you can build your own flows: CRM sync, WhatsApp messages, Google Sheets, custom confirmations, anything.

Video tutorial

Features

• Works with n8n, Make, Zapier or any endpoint that accepts a JSON POST
• Events for new orders and every status change (confirmed, processing, shipped, delivered, cancelled, returned)
• Signed payloads (HMAC-SHA256) so your endpoint can verify authenticity
• Automatic retries with backoff when your endpoint is down
• Delivery log with status, attempts and errors for every event
• Each endpoint gets its own signing secret, regenerable at any time
• No impact on your storefront speed — events are delivered in the background

What it does

Activating the add-on adds a Webhooks entry to your dashboard sidebar and a management page at /dashboard/webhooks. There you register one or more endpoints — the receiving URLs your automation tool gives you.

Each endpoint listens to the events you tick. These are the available events:

Event	Fires when
order.created	A new order lands in your store
order.confirmed	You mark the order as confirmed
order.processing	The order moves to processing
order.shipped	The order is shipped
order.delivered	The order is delivered
order.cancelled	The order is cancelled
order.returned	The order is returned

Every delivery is a JSON POST with an envelope carrying an event id, the event name, a created_at timestamp, your store_id and a data object. For order events, data holds the order (order number, status, payment and delivery type, customer name and phone, wilaya and commune, subtotal, shipping, discount and total, promo code, tracking number and delivery company) plus the list of its items.

{
  "id": "evt_...",
  "event": "order.created",
  "created_at": "2026-08-12T10:20:30+00:00",
  "store_id": 123,
  "data": { "order": { }, "items": [ ] }
}

Verification handshake

A brand-new endpoint receives no real events until it proves it is listening. Right after you add it, DZBuild sends a webhook.verify event; as soon as your URL answers with a success status (HTTP 200), the endpoint flips from Pending verification to verified and starts receiving your order events. Most of the time this happens in the same click; otherwise it retries on its own, usually within a minute.

Signature and headers

Every event carries headers your tool can check:

X-DZ-Token: <your endpoint secret>
X-DZ-Timestamp: 1754200000
X-DZ-Signature: t=1754200000,v1=hex( HMAC_SHA256( secret, timestamp + "." + rawBody ) )

• No-code check — compare X-DZ-Token against your secret. In n8n this is the built-in Header Auth credential.
• Advanced check — compute HMAC-SHA256 with your secret over timestamp + "." + rawBody and compare it to the v1 value. Reject anything older than 5 minutes.

Retries and auto-disable

If your endpoint is down or answers with an error, the delivery is retried up to 5 times with growing gaps — roughly a minute, then 5 minutes, 30 minutes, 2 hours and 12 hours. After that the delivery is marked as permanently failed in the log. An endpoint that keeps failing (10 consecutive failed deliveries) is disabled automatically, and the row shows a note telling you to fix your server and re-enable it. Re-enabling resets the failure counter.

Benefits

• Automate the boring part of COD. A new order can create a CRM record, append a row to Google Sheets, or trigger a WhatsApp confirmation without you touching the dashboard.
• React to status changes instantly. Shipped and delivered events let you send your own follow-up messages, or update an external sheet your call-centre team works from.
• No polling, no export files. You stop exporting orders manually — the events arrive as they happen.
• You can trust what arrives. Signed payloads mean your flow can reject anything that did not come from DZBuild.
• Failures are visible. The delivery log shows exactly which events landed, how many attempts they took and the error your server returned — no guessing why a flow did not run.
• Your storefront stays fast. Delivery happens in the background, so checkout speed is never affected.

How to activate

1. Open Dashboard → Add-ons at /dashboard/addons.
2. Find Webhooks under Tools.
3. Click Activate. The add-on requires the Unlimited plan (Enterprise included) — on lower plans the card is locked. See Plans → Unlimited.
4. Activation takes you straight to the management page, and a Webhooks entry appears in the dashboard sidebar.

warning

If a notice says the webhooks service is being set up, the Add button stays disabled. Try again later or contact support — nothing is wrong with your store.

Using it

1. Add an endpoint

1. In your automation tool, create a Webhook trigger (in n8n, the Webhook node) and copy its receiving URL.
2. Paste it into Webhook URL on /dashboard/webhooks.
3. Tick the events you want — New order is pre-selected; at least one event is required.
4. Click Add.

URL rules the form enforces: the URL must start with https://, use the standard HTTPS port, point to a domain name (not a raw IP address), carry no username or password, and not be a DZBuild domain. The same URL cannot be registered twice on the same store.

The counter next to Your endpoints shows how many endpoints you are using out of the limit your plan allows — the Unlimited plan allows one endpoint, Enterprise up to three.

2. Save the secret

Right after the endpoint is created, a window shows its signing secret with a copy button.

warning

The secret is displayed once. Copy it and store it safely — it is never shown again. If you lose it, use Regenerate secret on the endpoint row and update your tool with the new value; the old secret stops working immediately.

The same window offers Copy verification code (advanced), which copies a ready-made n8n Code node that checks the signature for you, with your secret already filled in.

tip

For a no-code setup in n8n, open the Webhook node, set Authentication to Header Auth, create a credential with the name X-DZ-Token and paste your secret as the value. Any request without that secret is then rejected automatically.

3. Verify and test

• While the endpoint shows the Pending verification badge, click the send button on its row to resend the verification event. Once your URL answers successfully, the badge disappears.
• On a verified endpoint the same button sends a test event (webhook.test) so you can confirm the whole flow end to end. It arrives in about a minute. The endpoint must be enabled for the button to work.

4. Watch the delivery log

The list button on each row opens the Delivery log — the last 50 events for that endpoint, with columns for event, status, attempts, HTTP code, error and date. Statuses are Pending, Sending, Delivered and Failed permanently.

5. Manage endpoints

Each row has buttons to send a test event, open the delivery log, regenerate the secret, pause or resume the endpoint, and delete it. Deleting an endpoint also removes its delivery log, and cannot be undone.

Deactivating the add-on from /dashboard/addons stops new events from being detected; your endpoints and their settings are kept, so reactivating later picks up where you left off.

FAQ

Which plan do I need? The Unlimited plan or above. On Free and Pro the add-on card is locked; upgrading unlocks activation — see Plans → Upgrades.

Why does my endpoint say "Pending verification"? Because your URL has not answered the verification event with a success status yet. Make sure the flow in n8n, Make or Zapier is active (not just in test mode) and that it replies HTTP 200, then press the send button on the row to retry.

My endpoint was disabled on its own. Why? Because it failed too many deliveries in a row — usually a flow that was turned off, or a server that stopped answering. Fix the receiving side, then press the enable button on the row; the failure counter resets.

Do I need to write code to secure my webhook? No. Checking the X-DZ-Token header against your secret is enough for most flows, and n8n does it for you with Header Auth. The HMAC signature in X-DZ-Signature is there if you want the stricter check.

Does this affect my store's speed? No. Events are sent in the background, so your storefront and checkout are never slowed by a webhook — see Selling → Orders for the order flow itself, and Add-ons → Overview for the full add-on list.