Shopify webhook (public)
POST/api/hooks/shopify
ONE url for every shop and topic of the public app (doc 86 §4.4),
including the three mandatory privacy topics
(customers/data_request, customers/redact, shop/redact).
X-Shopify-Hmac-SHA256 (base64 HMAC-SHA256 of the raw body, client
secret) is checked first: a bad one is 401. The shop is routed by
X-Shopify-Shop-Domain; a shop we do not hold, an ignored topic or a
duplicate (X-Shopify-Webhook-Id) is 200. Order topics queue a
re-read of the order; the redact topics erase at once.
Request
Responses
- 200
- 401
Accepted, or acknowledged with nothing to do.
The signature does not verify.