baselinker-webhooks

BaseLinker Webhooks

BaseLinker (rebranded Base.com) is a Polish multichannel e-commerce platform — order management, warehouse/inventory, and integrations with marketplaces, stores and couriers.

This is not a normal webhook source. Three things make BaseLinker unlike every other provider in this repo, and all three must be reflected in your handler:

1. The transport is HTTP HEAD, not POST. A HEAD request has no body by definition — reading req.body / await request.json() yields nothing or throws.
2. The entire payload is in the query string. Read it from the parsed query params. Query values are always strings — coerce numerics explicitly.
3. There is no signature verification. None. No HMAC, no signature header, no timestamp/replay check, no shared secret, no handshake or challenge step.

BaseLinker also publishes no webhook documentation at all. Its public API (api.baselinker.com, ~195 methods over connector.php) is strictly request/response, with change tracking done by polling (getJournalList, getOrderReturnJournalList, getInventoryProductLogs). Neither the English nor the Polish help centre documents an outbound webhook. Everything below about the wire format is stated as observed, not documented — see references/overview.md for exactly what was observed and what was not.

When to Use This Skill

• How do I receive BaseLinker (Base.com) webhooks?
• Why is my BaseLinker webhook body empty / why does req.body have nothing in it?
• How do I handle an HTTP HEAD webhook in Express, Next.js, or FastAPI?
• How do I read order_id and state from a BaseLinker callback?
• How do I verify a BaseLinker webhook signature? (You cannot — there is none.)
• Is X-BLToken a webhook signature? (No — it is the outbound API request header.)
• How do I track BaseLinker order changes reliably? (Poll getJournalList.)

Verification (core): there is none

BaseLinker provides no cryptographic authentication for these callbacks. There is nothing to verify with, so do not write an HMAC verifier, a signature header check, a timestamp/replay window, or a shared-secret comparison against something BaseLinker sends — none of those inputs exist. Inventing one produces a handler that silently rejects (or silently pretends to check) every delivery.