Shopify Webhook Trigger

Receive and verify webhooks from Shopify.

Overview

The Shopify Webhook Trigger runs a workflow when Shopify delivers a webhook event to a Spojit-generated URL. It verifies the X-Shopify-Hmac-Sha256 header against your shared secret so only payloads from your store are accepted.

Use it for real-time storefront automations: syncing new orders to ERPs, posting Slack alerts for high-value purchases, processing refunds, updating inventory in connected systems, and triggering AI-driven personalization on customer events.

What You Can Do

The Shopify Webhook Trigger receives signed event payloads from Shopify and exposes them to the workflow body:

orders/create, orders/updated, orders/paid, orders/cancelled, orders/fulfilled - order lifecycle events.
products/create, products/update, products/delete - product catalog events.
customers/create, customers/update, customers/delete - customer events.
inventory_levels/update - inventory adjustments at the location level.
refunds/create, fulfillments/create, checkouts/create - financial and fulfillment events.
X-Shopify-Topic header - the event topic, useful for branching workflow logic.
X-Shopify-Shop-Domain header - the source store, useful when one workflow handles multiple stores.
body - the full Shopify event JSON exposed to the workflow once the HMAC is verified.

Authentication

The Shopify Webhook Trigger does not call the Shopify Admin API. Spojit verifies inbound requests using the X-Shopify-Hmac-Sha256 header against the secret you configure. To set this up in Shopify, open Settings -> Notifications -> Webhooks (or create a custom app and use its API secret), paste the Spojit-generated URL, choose the event topic and JSON format, and Shopify signs each delivery using the shop's shared secret.

Setting Up Your Connection

Go to Connections from the sidebar.
Click + Add Connection.
Search for Shopify Webhook Trigger and select it.
Enter the webhook secret (the Shopify API secret for custom apps, or the shop's notification secret). Spojit generates a webhook URL for you to copy.
Give your connection a name (for example "Acme storefront webhook") and click Save.
In Shopify, go to Settings -> Notifications -> Webhooks, click Create webhook, choose the event (for example orders/create), set the format to JSON, and paste the Spojit URL.
Save the webhook. Use the Send test notification button to confirm delivery in Spojit execution logs.

Using the Trigger

The workflow starts on a webhook trigger node bound to this connection. When Shopify delivers a verified event, the workflow runs against the payload. Use {{trigger.headers["X-Shopify-Topic"]}} to branch on event type and {{trigger.body}} to read fields like id, total_price, or line_items.

Tips

Create one Shopify webhook per topic. Mixing topics across a single connection makes branching logic harder and complicates retries.
Shopify retries failed deliveries with backoff for up to 48 hours. Make sure the workflow returns quickly so deliveries are not marked failed.
For multi-store automations, branch on X-Shopify-Shop-Domain to route the same workflow per shop.
Use the Shopify Webhook deliveries log in the admin to debug missing events alongside Spojit execution logs.

Common Pitfalls

The HMAC is computed over the raw request body. Any proxy that reformats JSON between Shopify and Spojit will invalidate the signature.
Shopify deduplicates by X-Shopify-Webhook-Id on retries. If the workflow has side effects, deduplicate runs using this header to avoid double-processing.
Some events (for example orders/updated) fire frequently on small changes. Filter or branch on the relevant field difference rather than running the full workflow on every update.
If you rotate the Shopify API secret, update the connection in Spojit at the same time, otherwise all deliveries will fail signature verification.

Common Use Cases

For technical API details and field specifications, see the Shopify Webhook Trigger trigger documentation.