Integration · shop platform
WooCommerce
Small plugin with signed order webhooks and a browser adapter.
How events reach WooCommerce
The shop's own webhooks are the authoritative source for purchases and refunds. Track verifies the signature, pairs the order with the browser purchase by order id and only then routes it on — consent is inherited, never assumed.
- Browser — the storefront script sends standard events with the visitor's consent state and click ids; the purchase carries the order id for pairing.
- Server — the shop's signed webhooks deliver paid orders and refunds with totals and line items; Track verifies every signature before accepting a record.
What Track receives
Two complementary paths, paired by order id in the ingest stage.
- Paid orders and refunds from the shop's signed webhooks: order id, totals, currency, line items and the customer's matching data — hashed on ingest.
- Standard browser events from the storefront (view, add to cart, checkout, purchase) with the visitor's consent record and captured click ids.
- The order id on both paths, so the verified shop record supersedes the browser purchase without double counting.
Never assumed
- Marketing consent: a shop webhook carries no consent of its own. Without a paired browser purchase the record stays an operational record and reaches only destinations that need no consent.
- Raw customer data in ad platforms — matching data is hashed before it is stored.
- Unsigned or unverifiable webhooks — a failed signature check is recorded and dropped.
Technical facts
- Pairing key
order_id— order id- Consent purpose
- Necessary
- Implementation status
- Implemented · tested with signed, recorded webhook payloads
- Vendor documentation
- Track documentation
What you need
Public identifiers can be typed in chat or the wizard; secrets go through the secure credential card or OAuth and are stored encrypted.
Public identifiers
- shop_domain
- Shop domain
- default_currency
- Fallback currency
Credentials
- Webhook secret
webhook_secret— stored in the encrypted vault
Consent
Shop webhooks carry no consent of their own. A verified order inherits the consent record of the paired browser purchase; without one it is stored as an operational record and never reaches an advertising platform.
Setup in a few steps
The assistant runs the detailed checks. You see the milestones that need a decision from you.
Connect the shop
Enter the shop domain and fallback currency. Track generates the webhook URL and the secret once.
Install the shop side
Install the pixel extension, plugin or app and register the webhooks with the generated secret.
Verify with a test order
The first signed webhook flips the connection to connected; the observed topics and the last webhook are shown live.
From Tracking Knowledge
Guides written by the team that builds this connector.
WooCommerce tracking with signed order webhooks: browser events, the purchase data layer and server-side truth
How the Track WooCommerce plugin installs the snippet, pushes a GA4-shaped purchase on the thank-you page and manages native WooCommerce webhooks signed with HMAC-SHA256 — and how orders, statuses and refunds map to canonical events.
Tutorial · 3 min read
Questions
Do I still need the browser purchase?
It is optional but valuable: it carries the visitor's consent record and click ids, which the server cannot know. The verified shop record supersedes it for value and items.
Is the same order counted twice?
No. Browser purchase, server API and shop webhook share the order-derived event id, and the conversion record keeps one row per order.
What happens if a webhook is retried by the platform?
Redeliveries produce deterministic event ids and hit the event-level dedup guard; nothing is counted again.
Connect WooCommerce
Set it up with the guided wizard or let the assistant do it in chat.