Webhooks

Where Layout POSTs the payload when an event fires. HTTPS only, and never a private or internal host. Layout sends a signed verification event when you save a new URL. A new subscription turns on once your endpoint answers it with a 2xx; an existing one keeps delivering to its current URL until the new one does.

Which environment's events this URL gets. Point a development tunnel at sandbox only, so it never sees a production order. Each environment signs with its own secret.