Webhooks

View as .md

Polar tells your store about payments, refunds and subscriptions through a webhook. It’s required: Polar isn’t offered at checkout until the environment has a webhook secret. Without deliveries, payments are confirmed more slowly, and refunds made in Polar don’t reach your orders.

Endpoint

https://yourstore.com/wp-json/zealden-polar/v1/webhook

The plugin’s settings show your exact address. Subscribe the endpoint to these events, and copy its secret into the environment’s Webhook secret:

order.paid, order.refunded, refund.updated
for subscriptions: subscription.created, subscription.active, subscription.updated, subscription.canceled, subscription.uncanceled, subscription.revoked, subscription.past_due

Set up the endpoint in both your live and sandbox organizations.

The Webhook endpoint card: the store’s webhook address with a Copy button, the events to subscribe, and the last delivery received from each environment.

1 Copy your exact webhook address. The card also shows when each environment last delivered.

Let the plugin do it

Set up in Polar… creates or reuses the endpoint and saves its secret, if the token has the webhooks:write scope.
Check with Polar on the webhook card reads the endpoint and its recent deliveries (needs webhooks:read). It says which events the endpoint lacks, and whether Polar has turned it off.
If any order.paid deliveries failed, Send missed order.paid events again asks Polar to resend them (needs webhooks:write).
The card also warns when a delivery Polar signed was turned away because the signature didn’t match your secret (usually an old or mistyped secret), and when your store took too long to answer. Polar gives up after 10 seconds. The warning includes a snippet that sends WooCommerce’s order emails after answering, which is usually what takes the time.

If a delivery is missed

The webhook is the source of truth, with two safety nets: the order-received page checks with Polar before it shows, and scheduled checks 15 and 60 minutes after checkout catch any payment the webhook missed. Site Health warns when the webhook has stopped arriving.

Deliveries are checked against every configured secret, so switching test mode never breaks the other environment’s endpoint. Requests that carry no Polar signature at all, such as bots probing the address, are refused without a warning: they aren’t Polar, and your secret is fine.

Checked against Payments via Polar for WooCommerce 1.3.1, 22 October 2026.