Developer Docs

Real-time webhooks

Subscribe to order, payment, and table events. Restrofi sends a JSON POST to your endpoint within 1 second of each event.

API Reference Developer support

Available events

Restrofi emits the following webhook events. Subscribe to one or all.

Event	Description	Key payload fields
`order.created`	Fired when a new order is placed via QR or POS	orderId, tableLabel, items, total, status
`order.status_changed`	Fired when an order moves from pending → preparing → ready	orderId, previousStatus, newStatus
`order.completed`	Fired when an order is marked complete by the kitchen	orderId, completedAt, total
`payment.completed`	Fired when a payment is successfully processed	paymentId, orderId, amount, method
`payment.failed`	Fired when a payment attempt fails	paymentId, orderId, reason
`table.status_changed`	Fired when a table is seated, vacated, or reserved	tableId, tableLabel, previousStatus, newStatus

Sample payload

Example JSON body for an order.created event.

order.created payload

{
  "event": "order.created",
  "orderId": "ord_01HX9K2M3R4V5W6",
  "restaurantId": "rest_01HX1A2B3C4D5E6",
  "tableLabel": "Table 7",
  "items": [
    {
      "itemId": "item_01",
      "name": "Paneer Tikka",
      "quantity": 2,
      "unitPrice": 320,
      "total": 640
    },
    {
      "itemId": "item_02",
      "name": "Butter Naan",
      "quantity": 4,
      "unitPrice": 60,
      "total": 240
    }
  ],
  "subtotal": 880,
  "gst": 158.40,
  "total": 1038.40,
  "status": "pending",
  "timestamp": "2026-04-16T14:23:11.412Z"
}

Verifying webhook signatures

Every Restrofi webhook includes a X-Restrofi-Signature header containing an HMAC-SHA256 signature of the raw request body using your webhook secret. Always verify this before processing events.

Node.js / TypeScript verification

import crypto from "crypto";

export function verifyRestroFiSignature(
  rawBody: string,
  signature: string,
  secret: string
): boolean {
  const expected = crypto
    .createHmac("sha256", secret)
    .update(rawBody)
    .digest("hex");
  return crypto.timingSafeEqual(
    Buffer.from(signature, "hex"),
    Buffer.from(expected, "hex")
  );
}

// In your webhook handler:
app.post("/webhook/restrofi", (req, res) => {
  const sig = req.headers["x-restrofi-signature"] as string;
  const rawBody = req.rawBody; // ensure body-parser preserves raw body

  if (!verifyRestroFiSignature(rawBody, sig, process.env.RESTROFI_WEBHOOK_SECRET!)) {
    return res.status(401).json({ error: "Invalid signature" });
  }

  const event = req.body;
  // handle event.event type...
  res.status(200).json({ received: true });
});

Retry policy

If your endpoint does not return a 2xx status code within 10 seconds, Restrofi will retry the delivery up to 3 times with 5-minute intervals between attempts.

Attempt 1

Immediate

First delivery on event fire

Attempt 2

+5 minutes

If attempt 1 fails or times out

Attempt 3

+10 minutes

Final retry. Event marked failed after this.

Important: Your endpoint must return a 2xx response quickly. Defer any heavy processing to a background queue and respond immediately with 200 OK.

Testing locally

To receive webhooks on your local machine during development, expose your localhost using a tunneling tool.

Using ngrok

ngrok http 3000
# Copy the https://xxxx.ngrok.io URL
# Add it as your webhook URL in Restrofi dashboard

Using webhook.site

Visit webhook.site and copy your unique URL. Paste it as the webhook endpoint in your Restrofi settings. You'll see all incoming payloads in the browser — no code needed.

Ready to integrate?

Browse the full API reference or get help from our developer support team.