Learn the workflow for integrating a website with WebWMS2U, including authentication, idempotency, status and webhooks.
Use a Server-Side Trigger
Suitable triggers include a completed form, confirmed booking, accepted order, verified payment or delivery update. Validate the event on the server and never expose the API key in browser JavaScript.
Authentication
Protect the key in a server environment or configuration. Use Authorization: Bearer with X-API-Version: 1. X-API-KEY is available when a server does not forward Authorization.
Idempotency and Status
A timeout does not prove failure. Generate one idempotency key per logical message and reuse it for retries. Store the returned message ID. Accepted, sent, delivered, read and failed are distinct states.
Webhook Design
- Verify the secret or signature
- Return success quickly
- Deduplicate events
- Validate structure
- Keep secrets out of logs
- Make database changes idempotent
- Allow delayed events
Routing
The API key identifies Meta or personal routing. Meta keys follow Cloud API service-window and template rules. Personal keys use the assigned connected device.