How to Trigger a Workflow from WooCommerce Webhooks
Start a Spojit workflow the moment a WooCommerce order is created, paid or updated, using WooCommerce's built-in webhooks with signature verification, so nothing waits for a schedule.
What This Integration Does
WooCommerce can call a URL whenever something happens in your store: an order is created or updated, a product changes, a customer registers. Pointing those webhooks at a Spojit workflow turns store events into instant automation: send paid orders to your warehouse or ERP, post high-value orders to Slack, add new customers to Klaviyo, or create a shipment. WooCommerce signs each delivery with a secret you choose, and Spojit checks that signature before the workflow runs, so nobody can trigger it by guessing the URL.
Each delivery starts one run. WooCommerce sends the full object (the whole order, for order topics) as JSON, so most workflows need no extra API call to read it. Order webhooks fire on every save, so a workflow that should act once per order must check whether it has already acted (see Common Pitfalls).
Prerequisites
- WooCommerce admin access (WooCommerce -> Settings -> Advanced -> Webhooks).
- Your site must be able to make outbound HTTPS requests; WooCommerce delivers webhooks through WordPress's scheduled actions.
- Optional: a WooCommerce connection in Spojit if the workflow writes back to the store.
Step 1: Create the Webhook Trigger
Add a Trigger node with type Webhook. Next to Signing connection, click + and pick Custom:
- Signature header name:
X-WC-Webhook-Signature - Algorithm:
SHA-256 - Encoding:
base64 - Value prefix: leave empty
- Signed payload:
Raw body - Event ID header:
X-WC-Webhook-Delivery-ID
Enter a long random secret, create the connection, and copy the webhook URL. Leave the response mode on Async so WooCommerce gets an immediate 202.
Step 2: Add the Webhook in WooCommerce
In WordPress, go to WooCommerce -> Settings -> Advanced -> Webhooks and click Add webhook:
- Name:
Spojit - order updated - Status: Active
- Topic: Order created, Order updated or another topic you need (one topic per webhook).
- Delivery URL: the Spojit webhook URL.
- Secret: the same secret as in Step 1.
- API version: the latest WP REST API version offered.
Save. WooCommerce sends a small ping request to the URL when the webhook is saved.
Step 3: Ignore the Ping and Filter Events
The ping's body contains only webhook_id, not an order. Add a Condition that continues only when {{ input.id }} is not empty. Then filter to the events you care about. For "act when an order is paid", add a second Condition on {{ input.status }} equal to processing (WooCommerce's status for paid orders awaiting fulfillment).
Step 4: Act on the Order
The whole order is in {{ input }}: {{ input.number }}, {{ input.total }}, {{ input.billing.email }}, {{ input.shipping }} and {{ input.line_items }}. Common next steps:
- Post orders over a threshold to Slack with
send-message. - Create the shipment in ShipStation, Shippit or DHL Express.
- Push the order to NetSuite with
upsert-record. - Add the customer to a Klaviyo list.
Step 5: Mark the Order as Handled
Because Order updated fires on every save, record that the workflow has acted. Add a WooCommerce step with raw-api-request, method PUT, path /orders/{{ input.id }}, body { "meta_data": [ { "key": "_spojit_synced", "value": "yes" } ] }, and add a Condition early in the workflow that stops when the order's meta_data already contains _spojit_synced. Saving the meta fires another Order updated webhook, which that Condition then stops.
Tips
- One topic per webhook: create separate webhooks for Order created and Order updated if they need different handling. Both send the same order shape, so a separate workflow per topic is the clearest way to tell them apart.
- Delivery logs: WooCommerce keeps recent delivery logs under WooCommerce -> Status -> Logs. Check them when a delivery seems missing.
- Background delivery: WooCommerce queues webhooks with Action Scheduler, so they can arrive a few seconds to a minute after the event on a quiet site. Real cron (instead of WP-Cron) makes delivery more predictable.
- Need replies? If WooCommerce must wait for the workflow (rare), switch the trigger to Sync and end the workflow with a Response node.
Common Pitfalls
- Auto-disabled webhooks: WooCommerce disables a webhook after 5 failed deliveries in a row (any non-2xx response). If your workflow URL changes or the signing connection is deleted, check the webhook's status and set it back to Active.
- Signature failures: the secret must match exactly, and the scheme needs Base64 with no prefix. A mismatch shows as rejected deliveries in the trigger's history.
- Loops: a workflow that updates the same order can trigger itself through Order updated. The handled-flag Condition in Step 5 prevents this.
- Caching and security plugins: they do not affect outbound webhooks, but firewall rules that block outbound requests from the server do. Ask your host if deliveries never leave.
Testing
Place a test order (or change a test order's status) and open the workflow's run history in Spojit; the run should appear within a minute with the order in {{ input }}. Check that the ping did not start a full run, then switch your real actions on.