Enterprise-grade security, by default
Every event between ERPNext and your stores is signed, verified, and replay-protected. OrderWeave uses HMAC-SHA256 so your data stays authentic and tamper-proof — no shared passwords on the wire.
Four layers of protection
Message integrity
Every payload is signed with HMAC-SHA256. Any tampering invalidates the signature and the request is rejected.
Replay prevention
Signed timestamps with a strict window stop attackers from replaying captured requests.
Timing-attack resistance
Signatures are compared in constant time, so response timing can't leak your secret.
Frequently asked questions
What authentication does OrderWeave use? +
HMAC-SHA256 request signatures between ERPNext and the ingestion API, with a shared secret that never leaves either system.
How does it prevent replay attacks? +
Each request includes a signed Unix timestamp; requests older than a short configurable window (default 5 minutes) are rejected.
Is my data isolated from other customers? +
Yes. OrderWeave is multi-tenant with complete data isolation per tenant.
What happens to a tampered request? +
Any change to the payload breaks the signature, so the request fails verification and is never processed.
Do I need to manage certificates? +
No. Setup is a single base64 shared secret configured in ERPNext and your tenant record.
Ready to automate your inventory?
Every plan includes a fully managed ERPNext instance, set up for you.