The technical reference for Hangerline

Architecture Live

Hangerline runs entirely on edge infrastructure — there is no origin server to slow down or fall over.

Outbound webhooks Live

Register up to 5 HTTPS endpoints per boutique from the dashboard. Each endpoint gets a whsec_ signing secret, and every delivery is signed so your server can prove the payload came from Hangerline and was not altered.

Delivery format

POST https://your-server.example/webhooks/hangerline
content-type: application/json
user-agent: Hangerline-Webhooks/1.0
x-hangerline-event: inventory.adjusted
x-hangerline-signature: 3f1a9c…(64 hex chars)…b2e

{
  "event": "inventory.adjusted",
  "created_at": "2026-08-03T18:04:11.000Z",
  "data": {
    "product_id": 42,
    "sku": "DRS-SLK-08",
    "quantity_before": 5,
    "quantity_after": 4
  }
}

Verify the signature

import { createHmac, timingSafeEqual } from 'node:crypto'
import express from 'express'

const app = express()

// IMPORTANT: verify against the RAW body, before any JSON parsing.
app.post('/webhooks/hangerline', express.raw({ type: 'application/json' }), (req, res) => {
  const secret = process.env.BQOS_WEBHOOK_SECRET   // whsec_... from the dashboard
  const theirs = req.get('x-hangerline-signature') || ''
  const ours = createHmac('sha256', secret).update(req.body).digest('hex')

  const a = Buffer.from(ours), b = Buffer.from(theirs)
  if (a.length !== b.length || !timingSafeEqual(a, b)) {
    return res.status(401).send('bad signature')
  }

  const event = JSON.parse(req.body)
  console.log(req.get('x-hangerline-event'), event.data)
  res.sendStatus(200)
})

import hashlib, hmac, os
from flask import Flask, request, abort

app = Flask(__name__)

@app.post("/webhooks/hangerline")
def hangerline_webhook():
    secret = os.environ["BQOS_WEBHOOK_SECRET"]  # whsec_... from the dashboard
    theirs = request.headers.get("x-hangerline-signature", "")
    ours = hmac.new(secret.encode(), request.get_data(), hashlib.sha256).hexdigest()

    if not hmac.compare_digest(ours, theirs):
        abort(401)

    payload = request.get_json()
    print(request.headers.get("x-hangerline-event"), payload["data"])
    return "", 200

Worked example: a pos.sale.completed consumer

A complete consumer that verifies the signature, ignores events it doesn't care about, deduplicates, and reacts to a finished register sale — the most common integration (sync a sale into your accounting system, trigger a thank-you email, update an external stock feed).

import { createHmac, timingSafeEqual } from 'node:crypto'
import express from 'express'

const app = express()
const seen = new Set()   // in production, use your DB for idempotency

app.post('/webhooks/hangerline', express.raw({ type: 'application/json' }), (req, res) => {
  // 1. Verify the signature against the RAW body (constant-time compare).
  const secret = process.env.BQOS_WEBHOOK_SECRET
  const theirs = req.get('x-hangerline-signature') || ''
  const ours = createHmac('sha256', secret).update(req.body).digest('hex')
  const a = Buffer.from(ours), b = Buffer.from(theirs)
  if (a.length !== b.length || !timingSafeEqual(a, b)) return res.status(401).send('bad signature')

  // 2. Route by event type — ACK everything you don't handle so nothing queues up.
  if (req.get('x-hangerline-event') !== 'pos.sale.completed') return res.sendStatus(200)

  const { data } = JSON.parse(req.body)

  // 3. Deduplicate: there are no automatic retries today, but building
  //    idempotently now means retries-with-backoff can ship without breaking you.
  if (seen.has(data.sale_id)) return res.sendStatus(200)
  seen.add(data.sale_id)

  // 4. React to the sale — e.g. push it into your accounting system.
  console.log('Sale #' + data.sale_id + ': ' + (data.total_cents / 100).toFixed(2) + ' USD')
  console.log('  tax:', (data.tax_cents / 100).toFixed(2))
  console.log('  tender:', data.tender)   // { cash_cents, card_cents, gift_card_cents }
  for (const item of data.items) {
    console.log('  ' + item.quantity + 'x ' + item.name +
      ' (' + (item.sku ?? 'no SKU') + ') — ' + (item.line_total_cents / 100).toFixed(2))
  }
  if (data.loyalty_member_id) {
    console.log('  loyalty member #' + data.loyalty_member_id + ' earned ' + data.points_earned + ' pts')
  }

  // 5. Respond 2xx within 10 seconds — do slow work (email, sync) async after ACKing.
  res.sendStatus(200)
})

Shopping feeds Live

Tokenized, always-current catalog feeds for Google Merchant Center (RSS 2.0 XML) and Meta Commerce Manager (CSV). Paste the URL once — the feed stays in sync with your catalog.

Google XML sample

<?xml version="1.0" encoding="UTF-8"?>
<rss version="2.0" xmlns:g="http://base.google.com/ns/1.0">
<channel>
  <title>Heather's Boutique — Product Feed</title>
  <item>
    <g:id>DRS-SLK-08</g:id>
    <g:title>Silk Wrap Dress — Emerald</g:title>
    <g:link>https://your-store.example/products/silk-wrap-dress</g:link>
    <g:image_link>https://your-store.example/img/silk-wrap.jpg</g:image_link>
    <g:price>148.00 USD</g:price>
    <g:availability>in stock</g:availability>
    <g:condition>new</g:condition>
    <g:brand>Velvet &amp; Vine</g:brand>
  </item>
</channel>
</rss>

CSV product import Live

Bring your catalog from your current POS in minutes. The importer auto-detects the export formats of Clover, Square, Shopify and Lightspeed Retail and maps their columns automatically — or use the universal template.

Direct API sync with these systems is planned — it requires per-platform developer credentials and is not offered as “connected” until it truly is. CSV import is the honest, working path today.

Accounting exports Live

One-click bank-import CSVs your bookkeeper can load directly. Exports cover your most recent 5,000 succeeded and refunded payments; refunds are represented correctly, not fudged.

Provider connections Live

Connect your own Klaviyo (contact sync), Shippo (live carrier rates + label purchase) and Twilio (SMS) accounts by pasting your own API keys. Three rules make these connections trustworthy:

Every connection action — verifications, syncs, sends, label purchases, failures included — is written to a visible activity log in your dashboard.

Security model Live

Honest roadmap

Things this page does not document as available, because they aren't yet: