Confirm orders on WhatsApp from any platform

curl https://app.yudoo.io/api/v1/me -H "Authorization: Bearer wp_live_your_api_key"

{
  "store": { "name": "My Store", "url": "https://mystore.com", "connected_at": "2026-11-04T09:00:00.000Z" },
  "webhook": { "url": "https://mystore.com/yudoo/webhook", "events": ["order.confirmed", "order.cancelled"] }
}

Authorization: Bearer wp_live_your_api_key

curl -X POST https://app.yudoo.io/api/v1/orders \
  -H "Authorization: Bearer wp_live_your_api_key" \
  -H "Content-Type: application/json" \
  -d '{
    "id": "1042",
    "number": "1042",
    "status": "pending",
    "customer": { "name": "Mohamed Ali", "phone": "201001234567", "email": "[email protected]" },
    "currency": "EGP",
    "total": 540,
    "shipping_total": 40,
    "payment_method": "cod",
    "shipping_address": { "address1": "12 Tahrir St", "city": "Cairo", "province": "Cairo", "country": "EG" },
    "items": [
      { "name": "Cotton T-shirt", "variant": "White / L", "quantity": 1, "price": 250, "sku": "TS-WH-L" },
      { "name": "Sport socks", "quantity": 2, "price": 125 }
    ],
    "note": "Please deliver after 5 pm"
  }'

const res = await fetch("https://app.yudoo.io/api/v1/orders", {
  method: "POST",
  headers: {
    Authorization: `Bearer ${process.env.WHATPRO_API_KEY}`,
    "Content-Type": "application/json",
  },
  body: JSON.stringify({
    id: order.id,                       // your platform's order id
    number: order.number,
    customer: { name: order.customerName, phone: order.phone }, // 201001234567
    currency: "EGP",
    total: order.total,
    payment_method: "cod",
    items: order.lines.map((l) => ({ name: l.title, quantity: l.qty, price: l.price })),
  }),
});
const { order: saved, error } = await res.json();

$ch = curl_init("https://app.yudoo.io/api/v1/orders");
curl_setopt_array($ch, [
  CURLOPT_POST => true,
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_HTTPHEADER => [
    "Authorization: Bearer " . getenv("WHATPRO_API_KEY"),
    "Content-Type: application/json",
  ],
  CURLOPT_POSTFIELDS => json_encode([
    "id" => (string) $order->id,
    "number" => $order->number,
    "customer" => ["name" => $order->name, "phone" => $order->phone],
    "currency" => "EGP",
    "total" => $order->total,
    "payment_method" => "cod",
    "items" => array_map(fn($l) => ["name" => $l->title, "quantity" => $l->qty, "price" => $l->price], $order->lines),
  ]),
]);
$response = json_decode(curl_exec($ch), true);

import os, requests

res = requests.post(
    "https://app.yudoo.io/api/v1/orders",
    headers={"Authorization": f"Bearer {os.environ['WHATPRO_API_KEY']}"},
    json={
        "id": str(order.id),
        "number": order.number,
        "customer": {"name": order.name, "phone": order.phone},
        "currency": "EGP",
        "total": order.total,
        "payment_method": "cod",
        "items": [{"name": l.title, "quantity": l.qty, "price": l.price} for l in order.lines],
    },
    timeout=10,
)
saved = res.json()["order"]

{
  "order": {
    "id": "1042",
    "number": "#1042",
    "status": "pending",
    "confirmation": { "status": "pending", "at": null, "cancel_reason": null },
    "customer": { "name": "Mohamed Ali", "phone": "201001234567", "email": "[email protected]" },
    "currency": "EGP",
    "total": 540,
    "payment_method": "cod",
    "items": [
      { "name": "Cotton T-shirt", "variant": "White / L", "quantity": 1, "price": 250, "sku": "TS-WH-L", "product_id": null },
      { "name": "Sport socks", "variant": null, "quantity": 2, "price": 125, "sku": null, "product_id": null }
    ],
    "tracking": null,
    "created_at": "2026-11-04T10:00:00.000Z",
    "updated_at": "2026-11-04T10:00:00.000Z"
  }
}

curl https://app.yudoo.io/api/v1/orders/1042 \
  -H "Authorization: Bearer wp_live_your_api_key"

curl -X PATCH https://app.yudoo.io/api/v1/orders/1042 \
  -H "Authorization: Bearer wp_live_your_api_key" \
  -H "Content-Type: application/json" \
  -d '{
    "status": "shipped",
    "tracking": { "number": "7845120963", "url": "https://track.example.com/7845120963", "carrier": "Bosta" }
  }'

POST https://mystore.com/yudoo/webhook
Content-Type: application/json
Yudoo-Event: order.cancelled
Yudoo-Delivery: evt_k3j9x2m1q8w7e6r5t4y3u2i1
Yudoo-Signature: t=1793782800,v1=5f2b8c…e91a

{
  "id": "evt_k3j9x2m1q8w7e6r5t4y3u2i1",
  "type": "order.cancelled",
  "created_at": "2026-11-04T10:20:00.000Z",
  "data": {
    "by": "customer",
    "order": {
      "id": "1042",
      "number": "#1042",
      "status": "pending",
      "confirmation": { "status": "cancelled", "at": "2026-11-04T10:19:58.000Z", "cancel_reason": "Changed my mind" },
      "customer": { "name": "Mohamed Ali", "phone": "201001234567", "email": "[email protected]" },
      "…": "the same order object as GET /orders/{id}"
    }
  }
}

curl -X POST https://app.yudoo.io/api/v1/webhooks/test -H "Authorization: Bearer wp_live_your_api_key"

{ "delivery": { "id": "evt_…", "delivered": true, "error": null } }

Yudoo-Signature: t=1793782800,v1=5f2b8c0d…e91a

import crypto from "node:crypto";
import express from "express";

const app = express();
// Read the RAW body: the signature is over the exact bytes Yudoo sent.
app.post("/yudoo/webhook", express.raw({ type: "application/json" }), (req, res) => {
  const header = req.get("Yudoo-Signature") ?? "";
  const { t, v1 } = Object.fromEntries(header.split(",").map((p) => p.split("=")));
  const expected = crypto
    .createHmac("sha256", process.env.WHATPRO_SIGNING_SECRET)
    .update(`${t}.${req.body}`)
    .digest("hex");
  const fresh = Math.abs(Date.now() / 1000 - Number(t)) < 300;
  if (!fresh || !v1 || !crypto.timingSafeEqual(Buffer.from(expected), Buffer.from(v1))) {
    return res.status(400).send("bad signature");
  }
  const event = JSON.parse(req.body);
  // event.type: "order.confirmed" | "order.cancelled" | "webhook.test"
  res.sendStatus(200);
});

$raw = file_get_contents("php://input");
$header = $_SERVER["HTTP_WHATPRO_SIGNATURE"] ?? "";
parse_str(str_replace(",", "&", $header), $sig);   // ["t" => …, "v1" => …]

$expected = hash_hmac("sha256", $sig["t"] . "." . $raw, getenv("WHATPRO_SIGNING_SECRET"));
$fresh = abs(time() - (int) $sig["t"]) < 300;

if (!$fresh || !hash_equals($expected, $sig["v1"] ?? "")) {
  http_response_code(400);
  exit("bad signature");
}
$event = json_decode($raw, true);
http_response_code(200);

import hmac, hashlib, os, time
from flask import Flask, request, abort

app = Flask(__name__)

@app.post("/yudoo/webhook")
def yudoo_webhook():
    raw = request.get_data()  # the raw bytes, before any JSON parsing
    parts = dict(p.split("=", 1) for p in request.headers.get("Yudoo-Signature", "").split(","))
    expected = hmac.new(
        os.environ["WHATPRO_SIGNING_SECRET"].encode(),
        f"{parts.get('t')}.".encode() + raw,
        hashlib.sha256,
    ).hexdigest()
    fresh = abs(time.time() - int(parts.get("t", 0))) < 300
    if not fresh or not hmac.compare_digest(expected, parts.get("v1", "")):
        abort(400)
    event = request.get_json()
    return "", 200

HTTP/1.1 422 Unprocessable Entity

{
  "error": {
    "code": "missing_field",
    "message": "`customer.phone` is required, in international format with the country code (e.g. 201001234567).",
    "field": "customer.phone"
  }
}