In this guide
- A webhook is an HTTP request another system sends when an event happens, such as an order or a stage change.
- A server container needs a client that claims the webhook path and turns the body into event data.
- Verify the sender, handle retries with a stable ID and map fields carefully.
Not every event happens in a browser. Payments are confirmed on a provider's server. Deals move in a CRM. Orders are created by a back-office system. These systems talk to yours through webhooks. A tagging server on your own subdomain is a good place to receive them, because it already knows how to send events to ad platforms and analytics. This page explains how to do that safely. See CRM data to Meta with webhooks, Stripe purchase tracking and offline conversions.
How it works
A system sends a request
A POST with a JSON body to a path on your tagging subdomain.
A client claims it
A custom client in the server container recognises the path and reads the body.
The client builds event data
A name such as purchase and parameters from the body.
Tags fire
Meta, Google, GA4 and others send their requests.
The client answers
With a 200 status so the sender knows it arrived.
Raw events in. Clean events out.
Open Tracked collects each event on your own domain, removes the noise and sends what is left to Meta, Google Ads, TikTok.
Choose a path
Use a path that is not guessable, for example /hooks/orders-7f3a9. A separate path per sender makes it easy to see where each request came from. Open Tracked's Request Delay power-up (Business plan) can hold requests to a path for a number of minutes if you need to control timing.
Verify the sender
| Method | How |
|---|---|
| Shared secret in a header | The sender adds a header with a secret; the client rejects requests without it |
| Signature (HMAC) | The sender signs the body with a secret; the client recomputes and compares |
| IP allow list | Accept only requests from the sender's IP ranges, if published |
| Block Request by IP (Open Tracked, Business) | Refuse addresses you list, to cut abuse |
Prefer signatures, as Stripe and many others provide. A webhook endpoint without verification lets anyone post fake orders to your ad accounts.
3 things to remember
Scroll and the points stack up.
A webhook is an HTTP request another system sends when an event happens, such as an order or a stage change.
A server container needs a client that claims the webhook path and turns the body into event data.
Verify the sender, handle retries with a stable ID and map fields carefully.
Retries and duplicates
- Most senders retry if they do not get a 200 quickly. Answer fast.
- Include a stable ID (order ID, event ID) so a retry does not count twice. See event deduplication.
- Keep the handler small. Heavy work in the tags can delay the response.
Map the payload
| Webhook field | Event data field |
|---|---|
id | transaction_id and event_id |
amount (smallest unit) | value (divided by 100 if needed) |
currency | currency |
customer.email | Hashed for platforms, never sent to GA4 |
metadata.gclid, fbp, fbc | Click and browser IDs saved earlier |
Test
- Send a test webhook from the provider's dashboard.
- Watch server Preview: the request should be claimed and the tags fire.
- Send a request with a wrong secret: it must be rejected.
- Send the same event twice: platforms should count it once.
- Check the platform test tools.
Common problems
Brands that grow on cleaner data
Stores and agencies use Open Tracked to see which ads earn the sale.
Frequently asked questions
What is a webhook?
An HTTP request that one system sends to another when something happens.
Can a server container receive webhooks?
Yes, with a custom client that claims the path and builds event data.
How do I secure a webhook endpoint?
Verify a secret or signature, use an obscure path and consider IP restrictions.
How do I avoid duplicates?
Use a stable ID from the sender and deduplicate downstream.
Does Open Tracked host this?
Yes. Your tagging server runs on your own subdomain from the free plan.
Do I need spreadsheets to read my results?
No. Once tracking is live, the Open Tracked analytics shows spend, revenue, ROAS and profit, and you can ask Ari, the built-in AI assistant, questions about your own numbers in plain words. Ari's allowance depends on your analytics plan.
Is Open Tracked different from Open Track or Open Space Track?
No. Open Tracked is the official name of our server-side tracking platform, and the website is opentracked.io. Many people search for it as Open Track, OpenTrack or Open Space Track. All of them lead to the same product: server-side Google Tag Manager hosting, first-party analytics and a CRM pipeline.
Fix your tracking at the source
Open Tracked hosts your server-side Tag Manager, keeps first-party cookies alive and shows what each ad is really worth.
The Open Tracked team
We build Open Tracked: server-side tracking hosting, analytics and the tools around them, for stores that spend on ads. Questions about this guide, or an idea for the next one?
Comments
Loading comments...
Blog · 5 min read
