Shopify
Run a workflow on store events — an order is created or paid, a product changes, a customer signs up, a checkout is abandoned. The Shopify resource becomes the workflow's input.
For behavior shared by every provider (the delivery URL, testing), see the webhook triggers reference.
Prerequisites
Shopify webhooks are auto-registered: Cotera creates the webhook subscription for you over Shopify's Admin API, using a connected Shopify store. That requires the store's shop domain, client ID, and client secret (from a custom app). Without them, install fails with shopify_credentials_missing.
Setup
- Add a From an app trigger and pick Shopify.
- Choose the topic (see below).
- Save. Cotera subscribes to that topic against your store, pointed at the trigger's unique URL.
Deleting the trigger removes the subscription from Shopify.
Events
The event key is the Shopify webhook topic, delivered on the X-Shopify-Topic header.
| Topic | Fires when |
|---|---|
orders/create | An order is created |
orders/updated | An order is updated |
orders/paid | An order is paid |
orders/cancelled | An order is cancelled |
orders/fulfilled | An order is fulfilled |
products/create | A product is created |
products/update | A product is updated |
customers/create | A customer is created |
customers/update | A customer is updated |
checkouts/create | A checkout is created (e.g. an abandoned checkout) |
fulfillments/create | A fulfillment is created |
app/uninstalled | The app is uninstalled from the store |
Payload
The Shopify resource for the topic is passed through as the workflow input. An orders/create delivery looks like:
{
"id": 820982911946154500,
"name": "#1001",
"email": "jane@example.com",
"financial_status": "paid",
"total_price": "199.99",
"currency": "USD",
"line_items": [{ "id": 1, "title": "Widget", "quantity": 2, "price": "99.99" }]
}
Each topic delivers its own resource shape — products/* deliver a product, customers/* a customer, fulfillments/create a fulfillment, and so on. Shopify also sends an X-Shopify-Webhook-Id header, which Cotera uses to deduplicate retries.
Signature verification
Shopify signs each delivery and sends it in the X-Shopify-Hmac-Sha256 header — a base64 HMAC-SHA256 of the raw request body. The signing key is your app's client secret, so there's no per-trigger secret to manage. Cotera verifies the signature on every delivery and rejects anything that fails.