Registering the Webhook

The webhook URL#

License Cart receives Paddle events at:

https://your-site.com/wp-json/license-cart/v1/paddle/webhook

The exact URL for your site is displayed on the Dashboard tab (Quick Start Guide) and at the bottom of Settings under Webhook URL, with a click-to-select field.

Steps in Paddle#

1. In Paddle go to Developer Tools → Notifications and click New destination.
2. Enter a description, choose Webhook as the type and paste the webhook URL.
3. Select at least these events:
   • transaction.completed — issues a new license, or extends an existing subscription license on renewal
   • subscription.canceled — sets the license to revoked
   • subscription.paused — sets the license to inactive
   • subscription.resumed — sets the license back to active
4. Save the destination, open it and copy its Secret key into the matching Webhook Secret field in License Cart → Settings.
5. Repeat in your sandbox account with the same URL and the sandbox secret.

Other events you subscribe to are accepted and logged as skipped (“Event type not handled”) so Paddle does not keep retrying them.

How verification works#

Every webhook must carry a valid Paddle-Signature header. License Cart checks the HMAC-SHA256 signature against the active environment’s secret first, then falls back to the other environment’s secret, so live webhooks still issue licenses if you forgot to flip the environment switch. Timestamps older than five minutes are rejected to prevent replays. Requests that fail verification are logged on the Logs tab and rate-limited to 20 per 10 minutes per IP so a misconfigured sender cannot flood the log table.