Current boundary
Crave receives inbound provider webhooks from services such as Stripe, Square, and DoorDash. Those provider callbacks are private Crave infrastructure and are not an outbound developer event API. The repository contains persistence foundations for future outbound delivery, but the endpoint registry, event producers, delivery worker, signing contract, operator UI, and external acceptance evidence are not complete. Older examples that referenced events such asorder.created or
cart.abandoned, the X-Crave-Signature header, fixed retry delays, or a Settings > Webhooks
screen are not implemented contracts and must not be used for production integrations.
What to use today
- Use the Storefront API and SDK order-result resources for guest checkout outcomes.
- Use private, server-side management API keys only for the documented scoped routes.
- Use provider-specific integration guides only for the inbound provider configuration they explicitly describe.
- Coordinate polling, reconciliation, or brand-specific event requirements with your Crave integration owner before depending on them.
Planned contract
The outbound webhook contract will be published only after its endpoint lifecycle, versioned event schemas, signature and replay policy, retry and deduplication behavior, tenant isolation, delivery observability, and sandbox conformance tests are implemented. Event names and headers remain subject to change until that release.REST API Essentials
Review the currently supported public and private request boundaries.
Testing
Validate the API behavior that is available today.