Courier webhooks: get live parcel updates

Normally a parcel’s status is written once when you book it and never moves again. A webhook fixes that: the courier calls back to Sohoj Dokan whenever a parcel moves, so the order’s status, its journey timeline and your dashboard cards stay up to date on their own.

What a webhook gives you

• Parcel updates — picked up, in transit, out for delivery, delivered, returned and more — appear in your dashboard without you refreshing anything.
• Each update is written into the order’s journey on the order page, clearly labelled with the courier’s name.
• The parcel-status cards on your dashboard and the courier and parcel-status filters in the Orders list stay accurate.

The URL and the signing secret are two different values

For Pathao and Carrybee the courier needs two different values, and each goes into its own field:

• the Webhook URL — the callback address. It carries your store and a short URL token, and it is what the courier calls when a parcel moves.
• the signing secret — a separate value the courier sends back on every call so Sohoj Dokan can prove the event really came from the courier.

The signing secret is not part of the URL. Paste the URL into the courier’s callback/URL field and the secret into its signing/secret field — putting the wrong value in the wrong box means events are rejected.

Steadfast is different: it has no separate secret. Steadfast signs each call with the token already inside the URL, so you only paste the URL plus the token.

Steps

1. First connect the courier and save its credentials — see connect a courier.
2. Open Delivery Settings from the sidebar and switch to the Courier tab — the courier cards under Integrations → Shipping also link straight here.
3. Expand the courier you want (Steadfast, Pathao or Carrybee) to open its Webhook section inside the accordion.
4. Turn on Receive webhook events. On a fresh store the section says No webhook token yet and shows a Generate button; turning the toggle on, or tapping the button, provisions the credentials. The first time, the values are revealed together in a one-time panel — copy them now:
   • Pathao / Carrybee: the Webhook URL and the signing secret,
   • Steadfast: the Webhook URL and the token.
5. Once provisioned, the section shows:
   • the Webhook URL — a read-only address that carries your store and the URL token,
   • for Pathao / Carrybee the signing secret — shown as dots with a Copy button that copies the real secret; for Steadfast the token — shown as dots with a Copy button,
   • a last received event line, with a Signature verified or Signature not verified badge, so you can tell whether events are arriving and whether they passed verification.
6. Paste the values into the courier’s own portal. Each value goes into the field the courier asks for it in:
   • Steadfast: paste the URL and the token into your webhook settings. Steadfast signs each call with the token inside the URL.
   • Pathao: paste the URL as the Callback URL, and the signing secret into the Webhook secret field. The two are different values.
   • Carrybee: paste the URL as the callback, and the signing secret into the secret field.
7. Send a parcel, or wait for the next movement. When the first event arrives, the last received event line fills in and the parcel’s status updates on the order.

Note: Pathao and Carrybee each send a one-time “integration” event to confirm the connection. Sohoj Dokan answers it automatically, so the handshake completes on its own — there is nothing for you to respond to.

Note: This first wave is Pathao-first. Pathao parcel updates arrive now, while Steadfast and Carrybee order updates follow in a later wave — so their parcel statuses may not update immediately yet.

If you connected before this change

Earlier, the URL token doubled as the signing secret. Integrations created before the split may still be signing with the URL token, and the courier section tells you so with a warning. To move to a separate secret:

1. Tap Regenerate in the courier’s Webhook section.
2. Copy the new URL and signing secret from the one-time panel.
3. Paste both into the courier — the URL into the callback field and the secret into the signing/secret field.

Until you do, that integration keeps working exactly as before, using its token as the signing key.

When to regenerate the credentials

If the URL, token or signing secret is ever exposed — shared by mistake, or pasted somewhere it should not be — you can issue new ones yourself.

1. In the courier’s Webhook section, tap Regenerate.
2. A confirmation dialog opens. It warns you plainly: the old credentials stop working immediately. Because the URL carries the token, regenerating changes both the URL and the signing secret. For Steadfast, only the token (and the URL that carries it) changes.
3. Confirm. The new values appear in the one-time panel — copy them.
4. Paste the new values into the courier’s portal, replacing the old ones: for Pathao/Carrybee the new URL and the new signing secret (each into its own field); for Steadfast the new URL and token. Until you do, incoming events are rejected.

Note: Treat the signing secret (and the token) like a password — it is what proves an event really came from the courier, so never share or expose it. Secrets use the same alphabet as tokens (uppercase letters and digits) and need no escaping, so paste them exactly as shown, with no extra spaces.

Tips

• Paste each value exactly as shown — a stray space makes the courier’s events fail.
• For Pathao and Carrybee, keep the URL and the signing secret straight: the URL goes in the callback field, the secret in the signing/secret field.
• After regenerating, update the courier straight away. Until you do, incoming events are rejected.
• Watch the last received event line and its Signature verified badge after setup to confirm events are flowing.

What’s next

See how the updates show up on your dashboard and on each order — understand parcel statuses.