Skip to main content

Receive Webhook (TikTok → SKU.io)

POST 
/webhooks/tiktok-shop

Global (per-environment) endpoint that receives signed webhook events from TikTok Shop — this is the URL configured on the TikTok Shop app.

No bearer auth: the request is authenticated by TikTok's HMAC signature in the Authorization header (HMAC-SHA256 over app_secret + raw_body, keyed by the app secret — sandbox or production secret chosen by the resolved instance's environment setting).

Tenant routing: every account's webhooks arrive at this ONE URL. SKU.io identifies the account from the payload shop_id (top-level or data.shop_id), which must be the primary shop of a connected TikTok Shop integration.

Flow: 400 empty body → 404 missing/unknown shop_id → 401 invalid signature → 422 missing type → 200 event persisted + processing job dispatched.

Topics by type (TikTok's numbering for its webhook events):

  • 1 ORDER_STATUS_CHANGE
  • 2 REVERSE_STATUS_CHANGE
  • 3 RECIPIENT_ADDRESS_UPDATE
  • 4 PACKAGE_UPDATE
  • 5 PRODUCT_STATUS_CHANGE
  • 6 SELLER_DEAUTHORIZATION
  • 7 UPCOMING_AUTHORIZATION_EXPIRATION
  • 11 CANCELLATION_STATUS_CHANGE
  • 12 RETURN_STATUS_CHANGE
  • 21 FBT_INBOUND_STATUS_CHANGE (Fulfilled by TikTok inbound order status)

Any other type is stored as TYPE_{n} and not acted on.

Request​

Responses​

OK

Response Headers
    Content-Type