Provider guide

Shopify webhooks, kept properly.

Shopify signs every webhook and tells you the topic in a header, which makes it one of the easier providers to work with. It is also one of the easier ones to lose deliveries from, because a store that fails often enough simply stops being sent to.

Capture Shopify events free All providers

Field notes

How Shopify behaves, and where it bites

Topic in a header, HMAC in another, and a removal policy that turns repeated failure into silence.

How Shopify sends

Shopify POSTs JSON and names the topic in X-Shopify-Topic (orders/create, refunds/create), with the shop in X-Shopify-Shop-Domain and an HMAC in X-Shopify-Hmac-Sha256. It wants a 2xx quickly and treats a slow handler as a failure.

Where it bites

  • Repeated failure ends in removal. Shopify retries, then stops sending to an endpoint that keeps failing. Nothing errors afterwards, because nothing is sent.
  • One topic, many shops. An app installed across stores multiplies every topic by the install count, and a per-shop problem hides inside the aggregate.
  • The body is the only record of what the order looked like then. Products, prices and line items change. The delivery is the snapshot.

The vault under it

Point a WebhookVault endpoint at Shopify and every delivery is stored in full: headers verbatim, bodies byte-for-byte, labelled with its topic and searchable. Forward it onward to your own handler if you want the relay pattern, replay any delivery once the bug is fixed, and let a Watchdog notice the day it stops arriving.

01

Create an endpoint

Name it shopify-orders. Turn on forwarding to your own handler if you want the vault in front of it rather than beside it.

02

Register the capture URL

In the Shopify admin, Settings → Notifications → Webhooks, or via the Admin API for an app. Paste the capture URL and send a test.

03

Keep everything

Every delivery from here on is on the shelf: searchable, replayable, and watched for the day it goes quiet.

Verify from the record, not just at the door

Shopify signs the raw body with your webhook secret and sends the digest base64-encoded. The vault checks every capture against it and puts a verdict on the row.

The vault stores the signature headers verbatim with every request, so a delivery from last month can still be checked today. Verdicts are part of Solo and up. How verification works →

captured · orders/create✓ verified
# headers, stored verbatim
"X-Shopify-Topic": "orders/create"
"X-Shopify-Hmac-Sha256": "NxUqM6…="

{
  "id": 820982911946154508,
  "financial_status": "paid",
  "currency": "ZAR",
  "total_price": "49.00",
  "line_items": [
    { "title": "Field notebook", "quantity": 2 }
  ]
}

Event catalogue

Shopify webhook events you'll see

A few of the events Shopify sends, not the full list: Shopify's own documentation has every one. Each arrives in the vault labelled with its topic.

EventWhat it tells you
orders/createA new order was placed.
orders/paidAn order was paid in full.
orders/cancelledAn order was cancelled.
refunds/createA refund was issued against an order.
products/updateA product or one of its variants changed.
app/uninstalledA store removed your app (app subscriptions only).

Questions

Shopify webhook questions, answered

The three that come up most when Shopify is wired to a new endpoint.

How long does Shopify retry a failed webhook?

Shopify expects a 2xx within five seconds. A failed delivery is retried, currently up to eight times over about four hours, and an app subscription that keeps failing is removed. After that nothing arrives and nothing errors. A WebhookVault capture URL answers as soon as the delivery is stored, so a slow handler of yours never counts as a failure.

How do I verify X-Shopify-Hmac-Sha256?

Compute HMAC-SHA256 over the raw request body, keyed with your app's client secret (or, for webhooks created in the Shopify admin, the signing secret shown with them under Notifications), base64-encode it, and compare it with the header in constant time. Parse the JSON only after the check passes. On Solo and up the vault does this at capture and puts the verdict on every row.

Why did my Shopify webhooks stop arriving?

Usually because the subscription was removed after repeated failures, or the app was uninstalled from the store. Neither produces an error on your side; the deliveries simply stop. A Watchdog on the endpoint (Solo and up) raises the alarm when orders/create stops arriving at its usual rhythm.

Give Shopify a shelf to land on.

Free tier keeps 3 days while you evaluate; Solo keeps a month from $5.

Start free Read the docs