Cut-to-size order integration for your own shop or ERP

The CutOptim Configurator connects to a custom shop or ERP through two checks on your server: the signed quote and the signed webhook. Both are plain HMAC-SHA256, so any language can verify them, and reference examples in Node and PHP show how.

Two checks, both on your server

A custom platform has no plug-in to lean on, so the trust sits in two signatures. The browser can show a price, but only your server can decide to believe it.

Check the quote before the cart

The quote token is the price promise. Your server asks CutOptim whether it is genuine, unexpired and not yet used, then compares what it claims with the cart line.

1. Receive the order

   The page hands your script the cutoptim:order event with the order and its quote token.

2. Ask CutOptim

   Your server posts the token to /cfg/v1/quote/verify with your secret key. The answer says whether it is valid, whether an order has already used it, and which claims it carries.

3. Compare the claims

   The tenant, the currency, the expiry and the hash of the priced lines must match the line you are about to add. Anything else is refused.

4. Add or refuse

   Only a token that passes reaches the cart. A price changed in the browser fails here.

Receive the order by webhook

When an order is placed, CutOptim posts it to the address you registered, signed so that you can tell it came from us.

• — The CutOptim-Signature header carries a timestamp t and a signature v1: an HMAC-SHA256 of the timestamp, a dot and the raw body.
• — Verify the raw bytes exactly as received; a body that was parsed and written out again no longer matches.
• — Refuse a timestamp more than five minutes old or new, and compare signatures in constant time.
• — Store the event id and answer success for an id you have seen: a retry repeats it.

Reference code in Node and PHP

Two small examples do exactly this, with no framework and no dependency: a Node module and a single PHP file. Copy the one that fits, replace the in-memory store with a table that has a unique key on the event id, and keep your secrets in the environment.

import { createWebhookReceiver } from './cutoptim-verify.mjs';

const receive = createWebhookReceiver({
  secrets: [process.env.WEBHOOK_SECRET],          // whsec_... from the admin route, never in the repository
  async onEvent(event) { /* store event.data.order, keyed by event.id */ },
});

// in your HTTP handler - the RAW body, not parsed JSON:
const { status } = await receive({ rawBody, headers: req.headers });
res.writeHead(status).end();

What stays with you

The configurator prices and plans the cut; your platform keeps everything that comes after it.

• — The cart, the checkout and the payment: CutOptim collects no payment.
• — The order record and its fulfilment, in your database or ERP.
• — Your customers and your shop pages: there is no hosted shop.

Where it fits

Any system that can receive an HTTPS request and compute an HMAC can take these orders: a shop written in-house, a headless storefront, a quoting tool or an ERP. If you only need the cutting engine and not the ordering screen, the Engine API serves that.

Related calculators, guides and trades

• How to Order Cut-to-Size Panels Without Rework →

More about the configurator

Only need the cutting engine? See the Engine API

LegalConfigurator terms ·Data processing agreement ·Shopper privacy notice ·Third-party licences