Everything to know about Shopify Webhooks

Shopify webhooks are a powerful tool for automating your online store by instantly sending updates like order changes or inventory adjustments to other systems. Think of them as a bridge connecting your Shopify store with various platforms for seamless communication. This guide covers everything you need to know about Shopify webhooks, from what they are to how to set them up and maximize their benefits.

What are Shopify webhooks?

Shopify webhook is a feature that allows a website to notify other systems when events arise. For example, when you create a new order or customer, it will help other systems can actively take information from CRM when data arises. In particular, webhooks can also store those data.

With webhooks, you will receive push notifications when an event occurs. You will not need to probe the API to determine whether these events have occurred or not. Webhooks allows you to provide a URL for the webhook provider to send requests to. This means you need to set up a URL for your application to be accessible on the public web. Most webhooks will post the event data to the URL provided in one of two forms: as JSON (regular) or XML.

At the moment, most shop owners use Webhooks for:

• Adjusting the product’s price
• Creating an order
• Integrating accounting software
• Notifying your pager or IM customers when you are offline
• Collecting data to the data warehouse
• Deleting customer data from your database when they uninstall the application.
• Notifying shippers about orders and filter orders.

How does the Shopify webhook work?

Shopify webhooks are essentially HTTP callbacks that are triggered by specific events within your Shopify store. Here's a simplified breakdown of how they work:

• Event Occurs: An event happens in your Shopify store, such as a new Shopify order webhook being placed, a product being updated, or a customer account being created.
• Webhook Triggered: Shopify detects the event and triggers the corresponding webhook.
• HTTP POST Request: Shopify sends an HTTP POST request to the URL you specified when you set up the webhook.
• Data Received: The specified URL receives the data about the event in the form of a JSON payload.
• Action Taken: Your application or system processes the data and performs any necessary actions, such as updating inventory levels, sending notifications, or integrating with other systems.

Types of Shopify webhooks

There are 5 main types of Shopify webhook topics that store owners can use:

1. Order Webhooks: The Shopify order webhook example relates to order creation, updates, and fulfillment.
2. Product Webhooks: Triggered by product creation, updates, or deletion.
3. Customer Webhooks: Triggered when a customer account is created, updated, or deleted.
4. Checkout Webhooks: These are associated with Shopify checkout webhook creation, updates, and deletions.
5. Shop Webhooks: Triggered by store updates or changes to store settings.

These webhooks help automate and streamline interactions between Shopify and external services.

Why should you use Shopify webhooks?

Here are the reasons why you should apply the Shopify webhooks to your current online store:

• Shopify webhooks list provides a more efficient, real-time alternative to polling for changes in your store.
• Shopify webhooks can save server resources and ensure you get the information as quickly as possible.
• They help keep your systems in sync. Webhooks ensure your data is always current.
• They enable automation, allowing you to trigger workflows or notifications based on specific events without manual intervention.
• They’re incredibly versatile and can be tailored to fit your business needs perfectly.

Supported Shopify webhook events and topics

We learned about the concept of Shopify webhooks and know what it is often used for. Below is a list of supported Shopify webhook events and topics.

What can you do with Shopify webhook resource?

The Shopify API allows you to do the below with Shopify webhook resource:

• GET /admin/api/2021-01/webhooks.json (Bring back a list of webhooks)

Note: This endpoint implements pagination using the links provided in the feedback header since version 2019-10.

Bring back the list of all webhook subscriptions for your store

GET /admin/api/2021-01/webhooks.json

Bring back the list of all webhook subscriptions for your store after a specified id

GET /admin/api/2021-01/webhooks.json?since_id=4759306

• GET /admin/api/2021-01/webhooks/count.json (Bring back a count of all existing webhook subscriptions)

Count all webhook subscriptions for your store

GET /admin/api/2021-01/webhooks/count.json

Count all webhook subscriptions for the subject orders/create

GET /admin/api/2021-01/webhooks/count.json?topic=orders/create

• GET /admin/api/2021-01/webhooks/#{webhook_id}.json (Retrieve a single Webhook)

| fields | List of properties separated by commas for the items in the result list. Use this parameter to restrict the list of items returned to the properties you specify. |
|——–|——————————————————————————————————————————————————————-|

Bring back a single webhook by its id

GET /admin/api/2021-01/webhooks/#{webhook_id}.json

• POST /admin/api/2021-01/webhooks.json (Create a new Webhook)

Make a new webhook subscription by specifying both the address and the topic.

| format | Use this parameter to select the data format for the payload. Valid values are JSON and XML.

(JSON is the default value) |
|——–|———————————————————————————————————————————|

Sign up to order create webhooks

POST /admin/api/2021-01/webhooks.json
{
  "webhook": {
    "topic": "orders/create",
    "address": "https://whatever.hostname.com/",
    "format": "json"
  }
}

Trying to create a webhook register without address and subject will return error 422 - Entity could not process

POST /admin/api/2021-01/webhooks.json
{
  "webhook": {
    "body": "foobar"
  }
}

• PUT /admin/api/2021-01/webhooks/#{webhook_id}.json (Customize an existing webhook)
  Update the webhook registration topic or address URIs

Update your webhook registration, so it POSTs to another address

PUT /admin/api/2021-01/webhooks/#{webhook_id}.json
{
  "webhook": {
    "id": 4759306,
    "address": "https://somewhere-else.com/"
  }
}

• DELETE /admin/api/2021-01/webhooks/#{webhook_id}.json (Delete an existing Webhook)

Remove an existing webhook from a store

DELETE /admin/api/2021-01/webhooks/#{webhook_id}.json

The above is a summary of all you can do with Shopify’s webhook resource. Next, let learn about how to create Shopify webhooks with a few simple steps.

How to create Shopify webhooks?

Follow our detailed guide below to help you create a Shopify webhook from scratch:

Step 1: 

Navigate to Settings > Notifications in the Shopify admin.

Scroll down to the webhooks section.

Step 2:

Click the Create Webhook button. A new window should open.

Step 3: 

From the first drop-down, choose one "Event" from the following list:

• Cart creation: A webhook will be sent every time a cart is created.
• Cart update: A webhook will be sent every time a cart is updated.
• Checkout creation: A webhook will be sent every time a checkout is created.
• Checkout deletion: A webhook will be sent every time a checkout is deleted.
• Checkout update: A webhook will be sent every time a checkout is updated.
• Collection creation: A webhook will be sent every time a collection is created.
• Collection deletion: A webhook will be sent every time a collection is deleted.
• Collection update: A webhook will be sent every time a collection is updated.
• Customer group creation: A webhook will be sent every time a customer group is created.
• Customer group deletion: A webhook will be sent every time a customer group is deleted.
• Customer group update: A webhook will be sent every time a customer group is updated.
• Customer creation: A webhook will be sent every time a new customer is created.
• Customer deletion: A webhook will be sent every time a customer record is deleted.
• Customer disable: A webhook will be sent every time a customer account is disabled.
• Customer enable: A webhook will be sent every time a customer account is enabled.
• Customer update: A webhook will be sent every time a customer record is updated.
• Draft order creation: A webhook will be sent every time a draft order is created.
• Draft order deletion: A webhook will be sent every time a draft order is deleted.
• Draft order update: A webhook will be sent every time a draft order has been updated.
• Fulfillment creation: A webhook will be sent every time a fulfillment is created on an order.
• Fulfillment update: A webhook will be sent every time fulfillment is updated on an order.
• Order cancellation: A webhook will be sent every time an order is canceled.
• Order creation: A webhook will be sent every time an order is created.
• Order deletion: A webhook will be sent every time an order is deleted.
• Order edit: A webhook will be sent every time an order is edited.
• Order fulfillment: A webhook will be sent every time an order is fulfilled.
• Order payment: A webhook will be sent every time an order has been paid.
• Order update: A webhook will be sent every time an order has been updated.
• Product creation: A webhook will be sent every time a product has been created.
• Product deletion: A webhook will be sent every time a product has been deleted.
• Product update: A webhook will be sent every time a product has been updated.
• Refund create: A webhook will be sent every time a refund is issued.
• Shop update: A webhook will be sent every time a shop property is updated.
• Theme creation: A webhook will be sent every time a theme is created.
• Theme deletion: A webhook will be sent every time a theme is deleted.
• Theme update: A webhook will be sent every time a theme property is updated.

Step 4: 

From the second drop-down menu, select the format in which Shopify should provide you with this information. The two options are JSON and XML.

Step 5: 

Enter the URL where you want the data to be stored. It's worth noting that webhooks cannot be returned to the following URLs:

Step 6:

Click Save. Your webhook should now appear under the "Webhooks" section.

Step 7: Tap on Add webhook

After you’ve entered the URL, tap on Save webhook. Now, you can see your webhook display in the Webhooks field.

Step 8: Optional: Test your webhook

To make sure the information you want is sent to the correct URL, you can test your webhook by tapping on the send test notification link. Verify at the URL you have entered above to know that it is working properly.

How to use Shopify webhooks?

How to configure Shopify webhooks?

Configuring Shopify webhooks is a straightforward process. Here are the steps to get you started:

1. Log in to your Shopify admin panel.
2. Navigate to 'Settings', then 'Notifications'.
3. Scroll down to the 'Webhooks' section, and click 'Create a Webhook'.
4. Select the event from the dropdown menu for which you want to trigger the webhook.
5. Enter the URL where you want Shopify to send the webhook.
6. Save the webhook.

Once set up, Shopify will send an HTTP POST request to the specified URL whenever the selected event occurs.

How to test Shopify webhooks?

Here’s how you can test them:

1. Log in to your Shopify admin panel.
2. Navigate to 'Settings', then 'Notifications'.
3. Scroll down to the 'Webhooks' section, and click on the webhook you want to test.
4. Click 'Send test’. This will send a test HTTP POST request to the URL you specified for the webhook.

By clicking "Send test," you can verify that the URL is correct and that your server is receiving the webhook data properly.

How to create an endpoint for Shopify webhooks?

You must keep in mind that your endpoint needs to meet the requirement that it has to be an HTTPS webhook address with a valid SSL certificate. So it can handle event notifications correctly. Furthermore, you also need to perform a verification implementation to ensure the webhook requests originate from Shopify.

Payloads

For each payload, it will contain an XML or JSON object along with data for the webhook event. Depending on the event registered, the structure and content of each payload will vary.

Receiving a webhook

After you’ve just registered the webhook URL, you will receive an HTTP POST request sent by Shopify to the specified URL every time that event happens. The request contains JSON / XML data including POST parameters. For those parameters that are related to the event, they have triggered the request.

Note: You need to disable Cloudflare on your domain for registered webhook URLs if you are using it.

When distributing payloads to webhook HTTPs, Shopify will verify the SSL certificate. Ensure that your server has a standard configuration to support HTTPS. In addition, the SSL certificate is validated.

Responding to a webhook

It’s undeniable that your webhook receives data by sending a 200 OK response. This means that for any response outside the 200 range (including 3XX HTTP redirect code), you will not receive webhooks. Shopify will treat them as an error response and will not track redirects for webhook notifications.

Frequency

Shopify has applied a five-second waiting time, which means Shopify will wait five seconds to respond to each request for a webhook. Furthermore, Shopify has also implemented a retry period for subscriptions. In case of an error or no response, it will retry the connection with frequency 19 times / next 48 hours. Registration for webhook will be deleted if all 19 times fail in a row. The application’s emergency developer will receive an email warning that the subscription will be deleted.

To avoid such situations happening, you should consider delaying application processing until successfully sending webhook feedback.

Verifying webhooks

That electronic signature calculation is primarily used to verify webhooks created through APIs by a Shopify application. Each webhook request (including base64-encoded X-Shopify-Hmac-SHA256 header) is created by the application’s general secret along with the data sent in the request.

In addition, for webhooks created through Shopify administrators, they will be verified using the secret shown in the Webhooks field of the Notification page.

You can calculate the HMAC message using the following algorithm and compare it with the value in X-Shopify-Hmac-SHA256 to make sure it is a request from Shopify. It is true if two values ​​match. Conversely, if two values ​​are different, it is not required from Shopify.

Note: For Rack-based frameworks like Sinatra or Ruby on Rails, you’re looking for a title: HTTP_X_SHOPIFY_HMAClisher256.

Below are three examples using a different method to verify a webhook request:

• Ruby:

require 'rubygems'
require 'base64'
require 'openssl'
require 'sinatra'

# The Shopify app's shared secret, viewable from the Partner dashboard
SHARED_SECRET = 'my_shared_secret'

helpers do
  # Compare the computed HMAC digest based on the shared secret and the request contents
  # to the reported HMAC in the headers
  def verify_webhook(data, hmac_header)
    calculated_hmac = Base64.strict_encode64(OpenSSL::HMAC.digest('sha256', SHARED_SECRET, data))
    ActiveSupport::SecurityUtils.secure_compare(calculated_hmac, hmac_header)
  end
end

# Respond to HTTP POST requests sent to this web service
post '/' do
  request.body.rewind
  data = request.body.read
  verified = verify_webhook(data, env["HTTP_X_SHOPIFY_HMAC_SHA256"])

  # Output 'true' or 'false'
  puts "Webhook verified: #{verified}"
end

• PHP:

<?php


define('SHOPIFY_APP_SECRET', 'my_shared_secret');


function verify_webhook($data, $hmac_header)
{
  $calculated_hmac = base64_encode(hash_hmac('sha256', $data, SHOPIFY_APP_SECRET, true));
  return hash_equals($hmac_header, $calculated_hmac);
}


$hmac_header = $_SERVER['HTTP_X_SHOPIFY_HMAC_SHA256'];
$data = file_get_contents('php://input');
$verified = verify_webhook($data, $hmac_header);
error_log('Webhook verified: '.var_export($verified, true)); //check error.log to see the result

• Python:

from flask import Flask, request, abort
import hmac
import hashlib
import base64

app = Flask(name)

SECRET = ‘hush’

def verify_webhook(data, hmac_header):
digest = hmac.new(SECRET, data.encode(‘utf-8’), hashlib.sha256).digest()
computed_hmac = base64.b64encode(digest)

return hmac.compare_digest(computed_hmac, hmac_header.encode(‘utf-8’))

@app.route(‘/webhook’, methods=[‘POST’])
def handle_webhook():
data = request.get_data()
verified = verify_webhook(data, request.headers.get(‘X-Shopify-Hmac-SHA256’))

if not verified:
abort(401)

Best practices for Shopify webhooks

Here are some best practices for working with Shopify webhooks:

• Local Testing: Always test your webhooks locally before deploying them to ensure they work as expected.
• Asynchronous Processing: Handle webhooks asynchronously to ensure reliability and avoid blocking other processes.
• Verify Incoming Webhooks: Use Shopify's secret token to verify the authenticity of incoming webhook requests.
• Idempotency: Ensure your webhook processing is idempotent, meaning that receiving the same webhook multiple times won't cause duplicate actions.
• Handle Delays: Be prepared for potential delays in receiving webhooks and implement logic to handle late arrivals.
• Avoid Redirects: Ensure your webhook endpoint does not perform redirects, as Shopify will see this as an error.

Recover webhooks

There will be times when webhooks are temporarily unavailable due to some objective reasons like your application has been offline for a long time. Therefore, you will probably find a way to recover webhooks when you return. To do this, you just need to register the webhooks again and add the missing data.

• Re-register webhooks:
  As mentioned above, you need to do this to recover your webhooks. First, refer to the code of the application that originally registered the webhooks. Then you just need to add a check to fetch all existing webhooks. Finally, just register the ones you need.

• Adding the missing data:
  You need to fetch data from the time you shut down and then add them to your webhook processing code.

Duplicate webhooks

Shopify uses a very powerful weapon which is de-duplication to protect against duplication and flooding. As such, the fact that multiple actions are taken does not mean that there are also webhooks. De-duplication ensures that every 10-second window of time, only one webhook will be created. Webhook is released after 10 seconds containing the most updated payload.

For example: When you create a new product and update it multiple times within 10 seconds, only two webhooks will be created. The first webhook reports the event creating the webhook. The second webhook reports the latest status of the object after 10 seconds. You can also protect against duplicate webhook events by making your webhook handling behavior normal.

How to delete Shopify webhooks?

To delete Shopify webhooks, follow these steps:

1. Log in to your Shopify admin panel.
2. Navigate to 'Settings', then 'Notifications'.
3. Scroll down to the 'Webhooks' section.
4. Click on the webhook you want to delete.
5. Click 'Delete' to remove the webhook.

FAQs

What are Shopify webhooks used for?

Shopify webhooks automate tasks like order processing, inventory management, and app integrations by sending real-time updates to specific URLs.

How do I secure my Shopify webhooks?

Use HTTPS for webhook URLs and validate the HMAC signature provided by Shopify to ensure data integrity and security.

What happens if a webhook delivery fails?

Shopify will attempt to resend the webhook multiple times, allowing you to implement a retry mechanism to avoid data loss.

Can I test Shopify webhooks before using them live?

Yes, Shopify provides a built-in webhook testing feature, and you can also simulate events in a staging environment.

What's the difference between Shopify webhooks and APIs?

Webhooks push data automatically when an event occurs, while APIs require you to manually request data.

Final words

This article provides a comprehensive overview of Shopify webhooks, explaining their types, setup process, and how they can enhance store automation. To make the most of Shopify webhooks, readers should implement them thoughtfully to streamline operations and improve real-time data syncing with third-party services.

Related Posts:

• How to put Shopify store under construction?
• How to spy on other Shopify stores?
• What programming language does Shopify use?