Setting up a deployment webhook

Frontastic’s deployment webhooks feature notifies you whenever there’s a deployment update by calling the registered webhook URL with the deployment event message.

Register webhook

Contact the professional services team with the webhook URL and a secret text (usage explained later in this article) to register your webhook.

How does it work?

Frontastic will make a POST request to the registered webhookUrl upon a successful deployment with the following request body

{ 
  "event": "deployment.success", 
  "body": { 
    "environment": "staging", // staging or production
    "version": "2023.08.16.11.39", 
    "shopUrl": "<affected-shop-url>" 
  } 
}

Request headers

The request to your webhook URL will contain the following headers:

Verifying the request

It's essential to secure your webhook from malicious requests. Providing a webhookSecret while registering will let you verify the authenticity of the request in 3 simple steps:

Concatenate the x-commercetools-webhook-timestamp header with the request body as <timestamp>:<body>
Generate a hash of the string concatenated above using the HMAC SHA-256 algorithm with the registered webhookSecret.
Compare generated hash should be exactly the same as the x-commercetools-webhook-signature header value.