Wix integration (beta)

Inbound webhook receiver

Cobalz exposes POST /api/wix/webhook/<merchant_id> which accepts Wix-shaped order + refund events. It expects a signed body using your Wix shared secret (configurable per merchant under Settings → Store connection → Wix shared secret).

POST https://affiliate.cobalz.com/api/wix/webhook/<merchant_id>
Content-Type: application/json
X-Cobalz-Signature: t=<unix>,v1=<base64-hmac>

{
  "event": "order.created",
  "order": {
    "id": "<wix_order_id>",
    "totals": { "subtotal": 100, "total": 110, "currency": "USD" },
    "customer": { "email": "alice@example.com" },
    "appliedCoupon": { "code": "ALICE10" },
    "customFields": { "ref": "alice" }
  }
}

Signature scheme matches our other inbound webhooks: HMAC-SHA256(secret, "{timestamp}.{body}"), base64. The timestamp must be within 5 minutes of our wall clock.

Sample Velo backend code

// backend/cobalz.js — Wix Velo
import { fetch } from 'wix-fetch';
import { getSecret } from 'wix-secrets-backend';

export async function emitOrder(order) {
  const secret = await getSecret('cobalz_shared_secret');
  const body = JSON.stringify({ event: 'order.created', order });
  const timestamp = Math.floor(Date.now() / 1000);
  // Use crypto-js (npm install in your site dashboard) to compute HMAC
  const hmac = await import('crypto-js').then(C =>
    C.HmacSHA256(`${timestamp}.${body}`, secret).toString(C.enc.Base64),
  );
  await fetch(
    `https://affiliate.cobalz.com/api/wix/webhook/<merchant_id>`,
    {
      method: 'POST',
      headers: {
        'Content-Type': 'application/json',
        'X-Cobalz-Signature': `t=${timestamp},v1=${hmac}`,
      },
      body,
    },
  );
}

Tracker

Add the t.js script via Wix's Custom Code tool (Settings → Custom Code → Add Custom Code → place in Body — end).

Current limitations

• No auto-coupon creation. You'll set affiliate coupons manually in Wix and tell Cobalz the code via the affiliate detail page.
• No product catalog sync. Per-product commission rules need product IDs — paste them from Wix.
• No refund webhook in the Wix API surface; you'll need a custom Velo backend that listens to wixStores.onOrderUpdated.

Real OAuth + the App Market listing is on the roadmap. Track progress at our changelog.