Connect your store or website to the EL OUATINE platform: every new order, every submitted form and every booking lands instantly on your URL as a signed JSON notification — secure, reliable, with automatic retries.
Open dashboardDocumentation3 endpoints · 10,000 notifications per month · no credit card.
Every notification is signed with your secret and a timestamp bound into the signature — verify in two lines and reject any forgery or replay.
If your URL is unreachable we retry automatically: after 1 min, 5 min, 30 min, 2 h, then 12 h — no event is ever lost.
We reject localhost, private IPs and non-HTTP(S) protocols before saving — only your external URL is accepted.
Every notification is logged: status, attempt count, failure reason — with a “Send test” button to validate your URL first.
Subscribe only to YOUR OWN events — your store orders, your forms, your bookings.
| Event | Description | data.* |
|---|---|---|
order.created | New paid order in your store | order_id, service_name, price, currency, status, imei |
order.status | One of your orders changed status | order_id, service_name, price, currency, status, imei |
form.submitted | A new form was submitted | form_id, form_title, submission_id, fields{} |
booking.created | New booking on one of your services | appointment_id, service_name, slot, customer_name, customer_phone |
booking.status | One of your bookings changed status | appointment_id, service_name, status |
From your account: Webhooks ← new endpoint. Paste the receiver URL and pick events — you get the signing secret (shown exactly once).
On the receiver: recompute HMAC-SHA256 of timestamp + dot + raw body, compare — and reject any skew over 5 minutes.
Hit “Send test” from the dashboard — a signed webhook.test event arrives instantly. After that every real event arrives automatically.
const crypto = require('crypto');
const express = require('express');
const app = express();
const SECRET = process.env.WH_SECRET; // shown once when you created the endpoint
app.post('/webhook', express.raw({ type: 'application/json' }), (req, res) => {
const ts = req.headers['x-elouatine-timestamp'];
const sig = req.headers['x-elouatine-signature'];
const evt = req.headers['x-elouatine-event'];
const raw = req.body.toString('utf8'); // RAW body — do not JSON.parse first
// 1) Reject skew > 5 minutes (replay protection)
if (Math.abs(Date.now() / 1000 - Number(ts)) > 300)
return res.status(401).send('stale timestamp');
// 2) Recompute: HMAC-SHA256(secret, timestamp + '.' + rawBody)
const expected = 'sha256=' + crypto.createHmac('sha256', SECRET)
.update(ts + '.' + raw, 'utf8').digest('hex');
// 3) Timing-safe compare
const a = Buffer.from(sig || ''), b = Buffer.from(expected);
if (a.length !== b.length || !crypto.timingSafeEqual(a, b))
return res.status(401).send('bad signature');
const payload = JSON.parse(raw); // { event, delivery_id, sent_at, data }
console.log('event:', evt, 'delivery:', payload.delivery_id);
// ... handle payload.data ...
res.status(200).send('ok'); // 2xx = delivered
});{
"event": "order.created",
"delivery_id": 12345,
"sent_at": "2026-10-11T07:58:51.000Z",
"data": {
"order_id": 987,
"service_name": "iCloud FMI OFF",
"price": 12.5,
"currency": "USD",
"status": "paid",
"imei": "3548..."
}
}Abuse (abnormal rate, repeatedly dead URL) auto-disables the endpoint after 50 consecutive failures — re-enable it via support after fixing your URL.