Shopify Webhooks: Pick the Route, Then Create It

The Quick Verdict

Find your case in column one.

What a Webhook Sends, and to Whom

Someone asks you to add a webhook — a fulfilment partner, an accountant, a SaaS vendor. What they want is a standing instruction in your admin: when the chosen event fires, Shopify posts the record to their server. The event comes from a closed menu, not a free-text field.

What you get is an attempt at delivery, not a guarantee, and Shopify says so itself:

Admin Webhook, Flow or a Connector: Pick the Route First

The route decides who sets it up, whether the event is filtered first, and who hears when it breaks. Flow's Send HTTP request action is only available to the Shopify Plus, Advanced, or Grow plans, so the entry tier leaves you the admin webhook and installed apps.

Shopify Help Center and Shopify Dev Docs, read September 18, 2026.

The third row is the one merchants misread. Zapier and Make ship official App Store listings, and n8n documents a Shopify Trigger node, so a connector is a real route.

The listings do not say how the connector learns your event happened — by registering a subscription in your store, or by polling on a schedule. Zapier's own integration page does label each Shopify trigger Instant or Polling; for the others, ask the vendor, because the answer matters twice: polling adds delay you cannot see, and the failure email for app-created webhooks reaches you only if the connector created one. Then price webhook against poll.

How Do You Create a Webhook in Shopify?

None of the four is cosmetic: Shopify lets you edit a webhook after it is created but never its event, and the receiver depends on all four.

Creating webhooks, Shopify Help Center, read September 18, 2026.

Send test answers one narrow question: did a sample reach the address. Shopify's steps end with checking that at the URL itself and say nothing about the receiver keeping it, so confirm that before you call the integration live.

The Signature Your Receiver Checks

Anyone who learns your address can post to it, so the receiver should verify a delivery really came from your store: Shopify signs webhooks with an ID unique to your shop, while the HMAC check in its developer documentation is written for apps and uses the app's client secret. Neither page gives a verification recipe for a webhook created in the admin, so ask whoever builds the endpoint how they will confirm a delivery came from your store.

The API Version You Pick Has an Expiry

Shopify releases a new API version every three months, on the first day of the quarter, and supports each stable version for at least twelve months, with at least nine months of overlap, per its own versioning documentation.

When the version you picked becomes inaccessible, Shopify falls forward — its versioning page says so for webhooks specifically — and webhooks include an X-Shopify-Api-Version header to confirm which version was used. The page does not name the admin field, so treat this as the general rule and have the receiver read that header.

Topics themselves disappear. Shopify removed the checkout_and_accounts_configurations/update webhook on January 1, 2026, announced in a changelog post the previous August — so a webhook set and forgotten deserves a look.

When Delivery Fails: Deleted Without an Email

Shopify's page documents no banner, alert or log for a deleted subscription: it is gone from Settings > Notifications, and the orders that reached your accountant stop reaching them.

Whether an email reaches you depends on who created the webhook, not on how badly it failed: Shopify sends one only when an App Store app or a custom app created the subscription.

Shopify does publish delivery numbers — eight retries in a four-hour period, five seconds to respond, removal after repeated failures within 24 hours — on a page addressed to apps, and no page we have found extends them to a webhook created in Settings > Notifications.

So the defence is a habit, not a number. Compare what reached the other side with what Shopify recorded, on a schedule — the reconciliation loop behind any custom ERP integration.

Customer Data on Someone Else's URL

Shopify's sample payload for a new customer lists first and last name, email, phone, currency and the full default address — the record itself, not a ping saying a customer was created. The sample for a new order carries the same customer name, email and phone, plus the billing and shipping addresses.

The approval regime that covers apps does not obviously cover you: those requirements are written for apps and the Admin API, and no page we have found addresses a webhook a merchant creates. What an app may see is its own question.

So the checks before you save that address are yours:

• Who holds the data once it lands.
• Whether the address is access-controlled, not a catch-all.
• What your privacy policy promises about sharing.
• How you switch it off, which is deleting the subscription.

Erasure is the other half: when a customer asks you to delete their data, the copy on someone else's server is yours to chase, and Shopify's side of it stops at tools and notices.

Set It Up So You Notice When It Dies

Step one happens before you touch the admin, two and three on the day you create the webhook, and the last two keep it from disappearing unnoticed:

The Bottom Line

Shopify gives merchants a code-free way to push events out of a store, then documents the limits honestly: delivery is not guaranteed, a failing destination loses its subscription, and the email is reserved for app-created webhooks.

Frequently Asked Questions