# Shopify webhook trigger

> Run a workflow on Shopify store events: orders, products, customers, checkouts, and fulfillments, with HMAC signature verification.

Source: https://cotera.co/docs/reference/webhooks/shopify

---

Run a workflow on store events — an order is created or paid, a product changes, a customer signs up, a checkout is abandoned. The Shopify resource becomes the workflow's input.

For behavior shared by every provider (the delivery URL, testing), see the [webhook triggers reference](https://cotera.co/docs/reference/webhooks.md).

## Prerequisites

Shopify webhooks are **auto-registered**: Cotera creates the webhook subscription for you over Shopify's Admin API, using a connected Shopify store. That requires the store's **shop domain**, **client ID**, and **client secret** (from a custom app). Without them, install fails with `shopify_credentials_missing`.

## Setup

1. Add a **From an app** trigger and pick **Shopify**.
2. Choose the topic (see below).
3. Save. Cotera subscribes to that topic against your store, pointed at the trigger's unique URL.

Deleting the trigger removes the subscription from Shopify.

## Events

The event key is the Shopify webhook **topic**, delivered on the `X-Shopify-Topic` header.

| Topic                 | Fires when                                         |
| --------------------- | -------------------------------------------------- |
| `orders/create`       | An order is created                                |
| `orders/updated`      | An order is updated                                |
| `orders/paid`         | An order is paid                                   |
| `orders/cancelled`    | An order is cancelled                              |
| `orders/fulfilled`    | An order is fulfilled                              |
| `products/create`     | A product is created                               |
| `products/update`     | A product is updated                               |
| `customers/create`    | A customer is created                              |
| `customers/update`    | A customer is updated                              |
| `checkouts/create`    | A checkout is created (e.g. an abandoned checkout) |
| `fulfillments/create` | A fulfillment is created                           |
| `app/uninstalled`     | The app is uninstalled from the store              |

## Payload

The Shopify resource for the topic is passed through as the workflow input. An `orders/create` delivery looks like:

```json
{
  "id": 820982911946154500,
  "name": "#1001",
  "email": "jane@example.com",
  "financial_status": "paid",
  "total_price": "199.99",
  "currency": "USD",
  "line_items": [{ "id": 1, "title": "Widget", "quantity": 2, "price": "99.99" }]
}
```

Each topic delivers its own resource shape — `products/*` deliver a product, `customers/*` a customer, `fulfillments/create` a fulfillment, and so on. Shopify also sends an `X-Shopify-Webhook-Id` header, which Cotera uses to deduplicate retries.

## Signature verification

Shopify signs each delivery and sends it in the `X-Shopify-Hmac-Sha256` header — a **base64** HMAC-SHA256 of the raw request body. The signing key is your app's **client secret**, so there's no per-trigger secret to manage. Cotera verifies the signature on every delivery and rejects anything that fails.