Shopify Webhook Setup

Unlike Stripe and GitHub, Shopify doesn't let you configure one endpoint for all events. Each event topic (orders, fulfilments, customers, inventory) needs its own webhook. All of them can point at the same Watchtower ingest URL and flow through a single source.

Before you start

You'll need:

A Webhook Watchtower account with a workspace
Access to your Shopify admin (Settings permissions)

Step 1: Create a source in Watchtower

Go to Sources in your project.
Click Add source and choose Shopify as the provider.
Give it a name ("Shopify" is pre-filled, but you can customise it).
Leave the signing secret blank for now; you'll fill it in after the next step.
Click Create source and copy the generated ingest URL.

Step 2: Find your Shopify webhook secret

Shopify uses a single shared secret for all webhooks from your store, based on your app's API secret key. Where you find it depends on your setup:

Custom app: Go to your Shopify admin → Settings → Apps and sales channels → Develop apps. Open your app → API credentials. The API secret key is the value used for webhook signatures.

Public or partner app: The secret is the app's API secret key from your Partner Dashboard.

Copy this value and paste it into your Watchtower source's signing secret field. Save.

Step 3: Configure webhooks in Shopify

Shopify lets you set up webhooks via the admin UI or the Admin API. The admin UI only supports a subset of topics. For full coverage, use the API.

Via the admin UI: Go to Settings → Notifications, scroll to the bottom and find the Webhooks section. Click Create webhook. Choose the event topic, set the format to JSON, and paste your Watchtower ingest URL. Save.

Repeat for each event topic you want to receive.

Via the Admin API: Use the Webhook resource to create webhooks programmatically. Set address to your ingest URL and format to json.

Step 4: Verify delivery

Shopify doesn't have a built-in test send button from the admin UI. The fastest way to verify is to trigger a real event, for example by creating a test order.

The event should appear in your Watchtower dashboard with a Verified stamp. If you see Failed, re-check that the API secret key matches exactly between Shopify and your Watchtower source.

Duplicate event detection

Shopify adds an X-Shopify-Webhook-Id header to every webhook delivery: a UUID unique to that delivery. Watchtower stores this ID and uses it to detect re-deliveries.

If a duplicate arrives:

It's stored with a Duplicate label and a link to the original event
It's not forwarded to your destinations
It doesn't count toward your monthly event usage

This replaces the need to handle idempotency manually in your own code using the payload id field.

What Shopify's signature looks like

Shopify puts the signature in the X-Shopify-Hmac-SHA256 header as a base64-encoded HMAC-SHA256 digest:

X-Shopify-Hmac-SHA256: abc123base64==

This is different from Stripe (hex) and GitHub (hex with prefix). The Shopify preset handles this format automatically.

Per-topic webhooks

Shopify doesn't support a single "all events" endpoint. Each webhook is configured for a specific topic. To receive multiple event types, create a webhook for each one, all pointing at the same Watchtower ingest URL. They all flow through the same source and share the same event log.

Common issues

Failed verification: the most likely cause is using the wrong secret. Shopify uses the API secret key, not the API access token. Check you've copied the secret key (not the access token) from your app credentials.

Events not appearing: Shopify doesn't provide a detailed delivery log in the admin UI. If events aren't arriving, confirm the ingest URL is correct by checking your source settings in Watchtower, then trigger a test order and watch for it in the event list.

Duplicate events: Shopify can send the same event more than once, especially for orders that go through multiple state changes quickly. Watchtower detects these automatically using the X-Shopify-Webhook-Id header and won't forward duplicates to your destinations.