Send orders from your own website

Create an API key in Settings → Developers. Every request carries it in the Authorization header. Keys are shown once and never stored in plaintext on our servers after creation.

Authorization: Bearer om_live_xxxxxxxxxxxxxxxx

POST your order to /v1/orders. Supply an externalRef (your own order ID) and the call becomes idempotent — re-submitting the same reference returns the existing order rather than creating a duplicate.

curl -X POST https://api.ordermatrix.in/v1/orders \
  -H "Authorization: Bearer om_live_your_key_here" \
  -H "Content-Type: application/json" \
  -d '{
    "externalRef": "shop-order-1234",
    "customer": { "name": "Priya Sharma", "phone": "9876543210" },
    "address": { "line1": "12 MG Road", "city": "Bengaluru", "state": "Karnataka", "pincode": "560001" },
    "items": [{ "sku": "LIP-001", "name": "Red Lipstick", "price": 499, "qty": 2 }],
    "shipping": 50,
    "total": 1048,
    "paymentMethod": "prepaid",
    "paymentRef": "pay_abc123"
  }'

Fetch the same order back by externalRef:

curl https://api.ordermatrix.in/v1/orders?externalRef=shop-order-1234 \
  -H "Authorization: Bearer om_live_your_key_here"

Register a webhook URL in Settings → Developers. OrderMatrix will POST a JSON payload to your endpoint on every status change — shipped, delivered, cancelled. Each delivery carries an X-OM-Signature header you should verify before processing.

{
  "event": "order.shipped",
  "orderId": "665f...",
  "orderNo": "ORD-2026-0042",
  "externalRef": "shop-order-1234",
  "status": "dispatched",
  "tracking": { "courier": "Delhivery", "awb": "1234567890" },
  "at": "2026-10-01T14:30:00.000Z"
}

const crypto = require('crypto');

function verifySignature(rawBody, receivedSig, secret) {
  const expected = 'sha256=' + crypto
    .createHmac('sha256', secret)
    .update(rawBody)
    .digest('hex');
  return crypto.timingSafeEqual(
    Buffer.from(expected),
    Buffer.from(receivedSig),
  );
}

// Express example
app.post('/webhook', express.raw({ type: 'application/json' }), (req, res) => {
  const sig = req.headers['x-om-signature'];
  if (!verifySignature(req.body, sig, process.env.WEBHOOK_SECRET)) {
    return res.status(401).send('Unauthorized');
  }
  const event = JSON.parse(req.body);
  console.log(event.event, event.status);
  res.sendStatus(200);
});

Deliveries are retried 3 times at 0 s, 5 s, and 30 s. Your endpoint must return 2xx within 10 seconds.

Ready to connect your store?

Create a free account, generate an API key, and your first order will be in OrderMatrix within minutes.