To deliver a software license automatically after checkout, connect an eligible payment or fulfillment-ready event to a verified webhook receiver. The receiver should validate the request, check the order against your fulfillment rules, prevent duplicate issuance, and queue license creation and customer delivery. Return a successful response promptly; do the slower work in a background worker.
How a fulfillment webhook delivers a license
A webhook is an event notification sent to a URL you choose. When the commerce platform reports an order event, your endpoint receives an HTTPS POST; your system can then decide whether the order qualifies for a license. The event is a signal to check eligibility, not proof by itself that a key should be issued.
As an Amazon Associate I earn from qualifying purchases.
- Choose an event: Select a payment or fulfillment-ready trigger that matches your store’s policy.
- Authenticate the delivery: Verify the platform’s signature or hash against the original request body before trusting its contents.
- Check eligibility: Confirm the order and line items, and apply your paid, cancellation, refund, and risk rules.
- Prevent duplicate issuance: Record a durable event identifier and an issuance record for the relevant order or line item.
- Queue fulfillment: Save a job, return success quickly, then have a worker create or allocate the license and send instructions.
- Monitor and reconcile: Track outcomes, alert on persistent failures, and use platform logs or order reads to locate missed deliveries.
The right license schema, queue, email service, and refund policy depend on your store and licensing system; the platform documentation does not prescribe one universal design.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Repair Windows errors before they cause bigger problems3Scan for outdated or missing drivers - takes under a minuteChoose the trigger that matches your fulfillment policy
Payment event
A payment event can suit a store that considers a successful payment sufficient for delivery. Shopify’s Help Center documents an “Order payment” webhook event. Before using it, decide how the system will handle later cancellations, refunds, chargebacks, or orders that require review. Shopify’s webhook event documentation describes the available event selection.
#1 Best Overall
Fulfillment-ready event
Shopify Flow’s “Fulfillment order ready to fulfill” trigger is different: it runs after risk assessment and when inventory is available following release of an initial hold. Shopify also provides a workflow template for fulfilling digital items. This can fit a policy that waits for fulfillment readiness rather than issuing on payment alone. See Shopify’s fulfillment-ready trigger documentation.
For WooCommerce, webhook topics include order created, updated, and deleted. A topic tells you what changed; your receiver still needs to verify the current order state and decide whether that change makes the order eligible. See WooCommerce’s webhook guidance.
Build the receiver so retries are safe
Verify before parsing or acting
Accept deliveries over HTTPS and authenticate them before using event data. Shopify’s verification guide requires computing HMAC-SHA256 over the raw request body; JSON-parsing middleware must not alter or consume the body before verification. WooCommerce lets an operator configure a webhook secret, used to generate a hash sent in the request headers. Follow the corresponding platform procedure exactly: Shopify delivery verification and WooCommerce webhook setup.
Check order state and product rules
After authentication, validate the order identifier and relevant line items against the products or SKUs for which you issue licenses. Confirm the order is in an eligible state and apply your rules for refunds, cancellations, and risk review. Do not treat a valid signature as a guarantee that the order should receive a key; it establishes that the notification came through the platform’s authenticated delivery mechanism.
Make issuance idempotent
Platforms can redeliver events after a timeout or retry. Shopify specifically warns that the same webhook may arrive more than once and recommends idempotent processing or deduplication with X-Shopify-Webhook-Id. Persist that event identifier, and also make the license-issuance operation unique for the relevant order or line item. That second check protects against two different events or internal retries attempting to fulfill the same purchase. A repeated notification should find the existing fulfillment record, not create or email another key.
Acknowledge quickly; do the work asynchronously
Once the request is authenticated and safely recorded for processing, return a successful 2xx response promptly. Keep calls to a license server, key allocation, and email delivery out of the request handler. A background worker can retry its own job if a downstream service fails, without depending on the commerce platform to resend a webhook that your endpoint already acknowledged.
Rank #3
Shopify’s order-webhook documentation describes HTTPS POST delivery, retries, prompt acknowledgement, and out-of-band handling for long-running work. For the documented order-webhook context, Shopify says failed deliveries are retried up to 8 times over 4 hours with exponential backoff; these are Shopify-specific delivery details, not a general webhook guarantee. Consult Shopify’s order-webhook documentation for current guidance.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Set up and monitor webhooks by platform
Shopify
Choose the Order payment event if your policy permits delivery after payment, or consider Shopify Flow’s fulfillment-ready trigger if you need to wait for its risk and inventory conditions. Whichever event you use, verify the raw-body HMAC before parsing, deduplicate deliveries, and send slow work to a queue. Shopify documents verification and duplicate handling and order-webhook acknowledgement and retries.
WooCommerce
Configure the webhook’s topic, delivery URL, and secret, then verify the delivered hash at your endpoint. WooCommerce documents automatic disabling after more than five consecutive unsuccessful deliveries by default; the threshold can be adjusted with woocommerce_max_webhook_delivery_failures. Review delivery logs in WooCommerce status logs and investigate repeated failures before re-enabling or relying on the integration again. Defaults and merchant configurations can vary; see the developer setup guide and WooCommerce’s webhook and log documentation.
Custom integration or a packaged license tool?
A custom receiver gives you control over event selection, risk and refund eligibility, duplicate handling, and how delivery failures reach support. It also means you must build and maintain those safeguards and connect the receiver to a system that can create or allocate valid licenses.
For a WooCommerce store, API Manager is one packaged option to assess if its capabilities match your licensing workflow. Its documentation says the customer’s license and activations are created when an order has been paid: WooCommerce API Manager documentation. That statement comes from the product documentation; it is not an independent feature test or a guarantee that the product fits every license, activation, or refund policy. Compare any tool with your requirements for eligibility rules, duplicate protection, delivery and support workflow, and visibility into failed issuance.
Quick Recap
What to do when delivery fails
- The webhook fails before your endpoint records it: Inspect the platform’s delivery log and response status. Fix endpoint availability or verification errors, then follow that platform’s retry or recovery process.
- Your endpoint succeeds but the license worker fails: Retry the persisted internal job. Check that the worker uses the same issuance record so a retry cannot allocate a second key.
- The platform event was missed or delivery was disabled: Compare eligible paid orders with your fulfillment records. Shopify identifies
get_orderas an on-demand reconciliation path in its order-webhook documentation; WooCommerce provides delivery logs. - A customer says the key is missing: Check the order’s eligibility decision, issuance state, and delivery attempt separately. This helps distinguish a policy hold from a license-server problem or a failed message.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
