Which headers authenticate a Polar webhook?

Standard Webhooks validation uses `webhook-id`, `webhook-timestamp`, and `webhook-signature` with the endpoint secret and raw request body.

How quickly should the Polar endpoint respond?

Polar currently times out after 10 seconds and recommends a response within 2 seconds. Queue work that does not need to finish before acknowledgment.

Will a robots.txt rule stop Polar Webhooks?

No. The request goes to an endpoint registered in Polar. Remove or disable that endpoint if the integration should stop receiving events.

Does Polar Webhooks send content to AI systems?

No documented workflow does that. These requests report Polar account events to the configured receiver and have no AI search or training purpose.

Polar Webhooks: What It Is & How to Handle It

Q: What happens when Polar cannot deliver an event?

Polar can retry up to 10 times with exponential backoff. It disables an endpoint after 10 consecutive non-2xx deliveries, and an organization member must enable it again.

What is Polar Webhooks?

Polar Webhooks sends account events to endpoints chosen in an organization's settings. A raw endpoint receives JSON for the event types selected there, such as order.paid or subscription.canceled. Polar also supports message formats for Slack and Discord, but raw delivery is the documented format for a normal application integration.

Polar follows the Standard Webhooks specification. Each delivery includes webhook-id, webhook-timestamp, and webhook-signature headers, and the endpoint secret is used to sign the request. Polar's SDK validates those headers together with the raw body. A custom Standard Webhooks implementation must apply Polar's documented base64 handling to the secret.

A delivery attempt times out after 10 seconds, and Polar recommends responding within 2 seconds. Network errors and unsuccessful responses can trigger as many as 10 retries with exponential backoff. Redirects are treated as failures and are not followed. Polar also disables an endpoint after 10 consecutive non-2xx deliveries until an organization member enables it again.

This traffic carries Polar commerce events to a URL supplied by the account owner. It does not discover pages, contribute documents to AI search, or collect text for model training. robots.txt is irrelevant because Polar is delivering an event to a registered endpoint, not asking permission to crawl a path.

Not relevant for AI search

Is Polar Webhooks relevant for AI search?

No. Polar Webhooks is not part of AI search or training, so allowing or blocking it does not change your AI visibility.

Polar Webhooks is not a crawler. It delivers webhook notifications to endpoints you registered, so it never fetches public content for an AI product. Robots.txt does not apply, and allowing or blocking it has no effect on AI search or training.

How to handle Polar Webhooks

Create a dedicated raw endpoint and save its Polar webhook secret in protected configuration. Pass the untouched request body, headers, and secret to Polar's validateEvent helper or a conforming Standard Webhooks verifier. Reject the request before parsing or changing account state if signature verification fails.

After verification, persist the webhook-id or another durable event key and place slow work on a queue. Return a 2xx response promptly only after the event is safe to process. The stored key keeps a retry from applying the same account change twice.

Use Polar's delivery overview to inspect failures and request a redelivery. Point the configuration directly at the final URL because Polar does not follow redirects. If the endpoint was disabled after repeated failures, repair it before enabling it again. robots.txt cannot replace any of these controls.

Examples

An `order.paid` delivery passes Standard Webhooks validation, so the handler records its `webhook-id`, returns 202, and schedules access fulfillment.
A `refund.updated` handler times out before acknowledging the request. Polar retries it, and the stored delivery identifier prevents a duplicate accounting update.
An endpoint responds with a redirect to its preferred hostname. Polar records a failure, so the organization changes the saved webhook URL to the final HTTPS address.

Frequently asked questions about Polar Webhooks

Learn about AI visibility monitoring and how Promptwatch helps your brand succeed in AI search.

Only the event types selected for that endpoint are delivered. Polar documents events for orders, subscriptions, refunds, products, and other organization resources.