Picqer Webhooks Skill

When to Use This Skill

• How do I receive Picqer webhooks?
• How do I verify Picqer webhook signatures (X-Picqer-Signature)?
• How do I handle orders.completed, picklists.closed, or products.stock_changed events?
• Why is my Picqer webhook signature verification failing?
• Setting up a Picqer hook via the API (POST /api/v1/hooks)

Verification (core)

Picqer signs the raw request body with HMAC-SHA256 keyed on the per-hook secret you set when creating the hook, and sends the digest base64-encoded in the X-Picqer-Signature header. Pass the raw body (never re-serialized JSON) and compare timing-safe.

Important: The secret is optional at hook creation. If you create a hook without a secret, Picqer sends no X-Picqer-Signature header and signature verification is impossible. Always set a secret so requests can be verified.

Node:

const crypto = require('crypto');

function verifyPicqerWebhook(rawBody, signatureHeader, secret) {
  if (!signatureHeader || !secret) return false;
  const expected = crypto.createHmac('sha256', secret).update(rawBody).digest('base64');
  try {
    return crypto.timingSafeEqual(Buffer.from(signatureHeader), Buffer.from(expected));
  } catch {
    return false; // length mismatch = invalid
  }
}

Python:

import hmac, hashlib, base64

def verify_picqer_webhook(raw_body: bytes, signature_header: str, secret: str) -> bool:
    if not signature_header or not secret:
        return False
    expected = base64.b64encode(
        hmac.new(secret.encode(), raw_body, hashlib.sha256).digest()
    ).decode()
    return hmac.compare_digest(signature_header, expected)

The event type is in the JSON body's event field (there is no event header). Verify the raw body first, then parse and dispatch on payload.event.

For complete handlers with route wiring, event dispatch, and tests, see:

• examples/express/
• examples/nextjs/
• examples/fastapi/

Common Event Types

Picqer sends the event name in the payload's event field.

For the full event list, see references/overview.md and the Picqer webhooks documentation.

Payload Structure

{
  "idhook": 12345,
  "name": "My hook",
  "event": "orders.completed",
  "event_triggered_at": "2026-07-22 10:30:00",
  "data": { }
}

data holds the resource that triggered the event (an order, picklist, product, etc.). Picqer sends no dedicated idempotency key — deduplicate retried deliveries on the resource ID inside data (e.g. data.idorder) plus event and event_triggered_at.

Environment Variables

PICQER_WEBHOOK_SECRET=your_hook_secret   # The secret you set when creating the hook

Setting Up a Hook

Manage hooks in the dashboard (Settings > Webhooks) or via the API using HTTP Basic auth (your API key as the username, any/empty password):

curl -u YOUR_API_KEY: https://YOURSUBDOMAIN.picqer.com/api/v1/hooks \
  -H "Content-Type: application/json" \
  -d '{
    "name": "Order completed hook",
    "event": "orders.completed",
    "address": "https://your-app.com/webhooks/picqer",
    "secret": "your_hook_secret"
  }'

See references/setup.md for full details (deactivate, reactivate, retries, rate limits).

Local Development

# Start tunnel (no account needed)
npx hookdeck-cli listen 3000 picqer --path /webhooks/picqer

Reference Materials

• references/overview.md - Picqer webhook concepts and full event list
• references/setup.md - Creating hooks via the API, retries, rate limits
• references/verification.md - Signature verification details and gotchas