Shopify Webhook Setup Guide

For a connected Shopify account, no action is needed in the Shopify Admin. StackOne creates one webhook subscription per event you enable in StackOne Hub and points it at its own receiver, then deletes those subscriptions when the account is disconnected.

Inbound events are matched to your connection by the store’s myshopify.com domain, which Shopify sends in the X-Shopify-Shop-Domain header. Make sure the Shop Name on the connection matches that store so deliveries are routed to the correct linked account.

• Format: my-store (the subdomain only, taken from https://{shop-name}.myshopify.com)
• Example: acme-store for the store acme-store.myshopify.com

In the Shopify Admin, open Settings, select Notifications, then click Webhooks (“Send XML or JSON notifications about store events to a URL”).

On the Webhooks page, click Create webhook to open the subscription dialog.

• Note the signing secret shown under Your webhooks will be signed with on this page — Shopify uses it to sign each delivery so its authenticity can be verified.

In the Add webhook dialog, choose the store event under Event, leave Format as JSON, and paste the read-only Native Webhook URL (copied from the Linked account) into the URL field.

• Repeat this for each event you want delivered — Shopify creates one subscription per event.

Click Save. The new subscription appears in the list showing the event and the destination URL, confirming Shopify will now deliver that event to StackOne.

Events related to orders and their fulfillment and payment status.

• Order Created (orders/create) — Fired when a new order is created in Shopify
• Order Updated (orders/updated) — Fired when an order is updated in Shopify
• Order Deleted (orders/delete) — Fired when an order is deleted in Shopify
• Order Paid (orders/paid) — Fired when an order is fully paid in Shopify
• Order Cancelled (orders/cancelled) — Fired when an order is cancelled in Shopify
• Order Fulfilled (orders/fulfilled) — Fired when an order is fully fulfilled in Shopify
• Order Partially Fulfilled (orders/partially_fulfilled) — Fired when an order is partially fulfilled in Shopify

Events related to the product catalog.

• Product Created (products/create) — Fired when a new product is created in Shopify
• Product Updated (products/update) — Fired when a product is updated in Shopify
• Product Deleted (products/delete) — Fired when a product is deleted in Shopify

Events related to customer records.

• Customer Created (customers/create) — Fired when a new customer is created in Shopify
• Customer Updated (customers/update) — Fired when a customer is updated in Shopify
• Customer Deleted (customers/delete) — Fired when a customer is deleted in Shopify

Events related to fulfillments on orders.

• Fulfillment Created (fulfillments/create) — Fired when a new fulfillment is created in Shopify
• Fulfillment Updated (fulfillments/update) — Fired when a fulfillment is updated in Shopify

Events related to inventory levels and inventory items across locations.

• Inventory Level Updated (inventory_levels/update) — Fired when an inventory level changes in Shopify
• Inventory Level Connected (inventory_levels/connect) — Fired when an inventory item is connected to a location in Shopify
• Inventory Item Updated (inventory_items/update) — Fired when an inventory item is updated in Shopify

Events related to refunds on orders.

• Refund Created (refunds/create) — Fired when a refund is created in Shopify

Events related to checkouts, including abandoned checkouts.

• Checkout Created (checkouts/create) — Fired when a checkout is created in Shopify
• Checkout Updated (checkouts/update) — Fired when a checkout is updated in Shopify

Events about the StackOne app’s own installation. Enabling App Uninstalled is recommended so StackOne can react when the app is removed from the store.

• App Uninstalled (app/uninstalled) — Fired when the merchant uninstalls the app from their Shopify store

Shopify sends a separate HTTP request for each event — deliveries are not batched. The request body is the JSON of the changed resource (for example the full order for orders/create), while delete events carry only the resource id. StackOne routes each delivery to the matching event handler.

Each delivery includes headers StackOne relies on:

• X-Shopify-Topic — the event topic (for example orders/create), used to route the delivery to the right handler.
• X-Shopify-Shop-Domain — the store’s myshopify.com domain, used to match the delivery to the correct linked account.
• X-Shopify-Webhook-Id — a unique id per delivery, used for de-duplication.
• X-Shopify-Hmac-Sha256 — the HMAC-SHA256 signature Shopify sends so the payload’s authenticity can be verified.

Delivery is at-least-once: if StackOne cannot be reached, Shopify retries the delivery over roughly 48 hours before giving up. Because bulk changes (such as a stock update affecting several locations) emit one event per affected inventory level, expect multiple separate deliveries for a single bulk action.