Webhooks - Gamecart Docs

Gamecart sends order events to an HTTPS endpoint that you control. Each webhook is an outbound notification to your application, signed with a secret only you and Gamecart know.

Before you begin

You need:

The Enterprise plan. A store can have up to 10 endpoints.
Permission to manage integrations for the store.
A public HTTPS endpoint that accepts POST requests.
A safe place to keep the webhook secret.

Answer each request quickly. Move slow work to a background job after you accept the event.

Add an endpoint in the dashboard

Open Integrations > Webhooks.
Click Create endpoint.
Enter a Name, such as Production order worker.
Paste your public HTTPS URL in Endpoint URL. Gamecart checks the URL before it saves the endpoint.
Under Events, pick the events your application needs. Payment approved comes checked.
Click Create endpoint, then copy the secret from Save this webhook secret now. Gamecart shows it only once. Secrets start with gcwhsec_.
Open the endpoint’s row menu and select Send test to confirm that your endpoint receives the event and verifies the signature. See Testing and delivery logs.

Create webhook endpoint dialog with the endpoint URL, events, enabled switch, and Create endpoint button highlighted — Choose the HTTPS endpoint and only the events your application uses.

Turn off Enabled to pause deliveries to an endpoint without deleting it. You can also manage endpoints through the API with the webhooks:read and webhooks:write scopes. The endpoint pages under API reference list every operation.

Event types

Event	When it is created
`order.created`	A checkout order is created and finalized with a redirect URL.
`order.payment_approved`	Payment status changes to `APPROVED`. This also happens when a dispute closes in the store’s favor.
`order.payment_rejected`	Payment status changes to `REJECTED`.
`order.payment_cancelled`	Payment status changes to `CANCELLED`.
`order.payment_refunded`	Payment status changes to `REFUNDED`.
`order.payment_dispute`	Payment status changes to `DISPUTE`.

When a dispute closes in the store’s favor, Gamecart sends order.payment_approved again with the same eventId as the original approval. The order was already delivered at that first approval, so don’t deliver it again. Deduplicating by eventId handles this. Manual orders created in the dashboard do not send seller webhooks.

Diagnostic event

Event	When it is created
`webhook.test`	You select Send test in the dashboard or call the test operation of the API.

webhook.test is not an event you subscribe to. It goes to the endpoint you test, whatever events that endpoint listens to, and carries a fixed sample order with the id GC-TEST0000.

Delivery payload

Every event has the same envelope. The order sits under data.order and is the same object that GET /v1/seller/orders/{orderId} returns, always with the buyer:

{
  "eventId": "order.payment_approved:GC-7K9Q2X",
  "eventType": "order.payment_approved",
  "createdAt": "2026-09-25T13:05:00.412Z",
  "data": {
    "order": {
      "orderId": "GC-7K9Q2X",
      "number": 105,
      "createdAt": "2026-09-25T13:04:12Z",
      "paidAt": "2026-09-25T13:05:00Z",
      "paymentStatus": "APPROVED",
      "gatewayType": "STRIPE",
      "externalPaymentId": "pi_3Q1x2y3z",
      "currency": "USD",
      "subtotal": 20.00,
      "totalDiscount": 2.00,
      "total": 18.00,
      "manualAdjustment": 0.00,
      "deliveryStatus": "PENDING",
      "items": [
        {
          "id": 3121,
          "productId": 77,
          "name": "VIP rank",
          "unitPrice": 20.00,
          "effectivePrice": 20.00,
          "quantity": 1,
          "variables": []
        }
      ],
      "coupons": [{ "code": "SAVE10", "discountValue": 2.00, "fixedValue": true }],
      "discounts": [],
      "checkoutFields": [],
      "buyer": {
        "name": "Steve",
        "email": "[email protected]",
        "accountIdentifier": "Steve",
        "deliveryIdentityMode": "CHECKOUT_FIELD",
        "locale": "en-US"
      },
      "publicOrderUrl": "https://play.example.com/order/GC-7K9Q2X"
    }
  }
}

eventId is stable for the order and event type. Use it as your idempotency key.
createdAt is when Gamecart created the event, in UTC.
Fields that do not apply are left out, as in API responses.
number is the order number the seller sees. The webhook goes only to endpoints the seller configured, so it is safe to use there.

The payload holds the buyer’s personal data. Keep it only as long as your application needs it.

Delivery headers

Content-Type: application/json
User-Agent: Gamecart-Webhooks/1.0
Gamecart-Event-Id: order.payment_approved:GC-7K9Q2X
Gamecart-Event-Type: order.payment_approved
Gamecart-Signature: t=1790341500,v1=<hex_hmac_sha256>

See Webhook signatures for verification.

Retries

Gamecart treats any 2xx response as delivered. For a non-2xx response, network failure, or invalid target, Gamecart records the failure and makes up to 5 attempts. After each failure, the retry delay is attemptCount * 5 minutes. Gamecart does not follow redirects. If your endpoint receives the same eventId more than once, process it once and return 2xx for later duplicates. Delivery statuses are:

Status	Meaning
`PENDING`	Gamecart has not delivered the event successfully yet, or it is waiting for a retry.
`SENT`	Your endpoint returned a `2xx` response.
`FAILED`	Gamecart exhausted all retry attempts.

Retention

Gamecart deletes SENT and FAILED deliveries 30 days after they were created. Pending deliveries are kept until they finish.

​Before you begin

​Add an endpoint in the dashboard

​Event types

​Diagnostic event

​Delivery payload

​Delivery headers

​Retries

​Retention