WooCommerce webhook.

1. Get your webhook URL + secret

Sign in to your clinic dashboard and open Settings → Integrations. You'll see:

Webhook URL:  https://vgwrhrjadnlpvqkkkuly.supabase.co/functions/v1/woocommerce-order?vendor=<your-slug>
Secret:        <copy from dashboard — keep private>

Note.The secret is only shown once. If you lose it, regenerate from the dashboard. Don't commit it to source control.

2. Configure WooCommerce

In WordPress admin, go to WooCommerce → Settings → Advanced → Webhooks and click Add webhook.

3. Signature header

WooCommerce sends the payload signed with HMAC-SHA256, base64-encoded, in the X-WC-Webhook-Signature header. PepLab verifies the signature before processing.

X-WC-Webhook-Signature: base64(hmac_sha256(payload, your_secret))

4. Example payload

The minimum shape PepLab uses from each order:

{
  "id": 12345,
  "status": "processing",
  "billing": {
    "first_name": "Camden",
    "email": "patient@example.com"
  },
  "total": "75.00"
}

On a verified processing or completed order, PepLab:

• Creates an invite row scoped to your vendor.
• Generates a short clinic code (e.g. VAL-K7H2).
• Sends a branded invite email to the patient with App Store + code.
• Marks the invite sent once Resend accepts it.

5. Test fire

Use this curl from a shell to verify your wiring (replace the placeholders):

SECRET="<your-secret>"
URL="https://vgwrhrjadnlpvqkkkuly.supabase.co/functions/v1/woocommerce-order?vendor=<your-slug>"

PAYLOAD='{"id":99999,"status":"processing","billing":{"first_name":"Test","email":"you@example.com"},"total":"1.00"}'
SIG=$(echo -n "$PAYLOAD" | openssl dgst -sha256 -hmac "$SECRET" -binary | base64)

curl -s -X POST "$URL" \
  -H "Content-Type: application/json" \
  -H "X-WC-Webhook-Signature: $SIG" \
  -d "$PAYLOAD"

Note.You should get 200 OK and see the invite appear in your clinic dashboard within a second.

Need help?

Email hello@peplabhq.com with your clinic slug and we'll wire it for you in under 24 hours.