Shopify
Trigger Wexio flows from Shopify orders, carts, and customers
Shopify signs webhook bodies with HMAC-SHA256 and sends the base64-encoded signature in X-Shopify-Hmac-Sha256. You connect it with the Shopify preset, which uses Generic HMAC SHA-256. This mode has no replay protection, because the signature covers the body only and carries no timestamp.
Provider docs: Setting up webhooks in Shopify
Setup
1. Connect It in Wexio
Go to Settings → Webhooks and API → Webhooks → New connection → Inbound. Under Provider presets, click the Shopify chip in HMAC presets. It sets Authentication mode to Generic HMAC SHA-256 and fills in these fields. Check that they match.
| Field | Value |
|---|---|
| Signature header name | X-Shopify-Hmac-Sha256 |
| Encoding | Base64 |
| Header prefix (optional) | Leave empty |
Copy the Wexio endpoint URL. You paste the signing key into Signing secret after the next step.
2. Set Up the Provider
In the Shopify admin, go to Settings → Notifications → Webhooks → Create webhook. You can also use the Admin API for programmatic setup.
| Field | Value |
|---|---|
| Event | For example orders/paid, checkouts/create, customers/create |
| Format | JSON |
| URL | The Wexio endpoint URL |
| Webhook API version | Latest stable |
Shopify shows a Webhook signing key once per shop in Settings → Notifications. Copy it into the Wexio Signing secret field. This key signs all webhooks for the shop, not one per endpoint.
3. Resolve Contacts
| Identifier type | JSON path | Notes |
|---|---|---|
$.email | Order-level events | |
$.customer.email | Customer-nested events | |
| Phone number | $.phone | When SMS marketing is involved |
4. Capture the Schema and Bind a Flow
Send a test webhook with Shopify's Send test notification button and let Wexio capture the schema. Then add a Webhook Received trigger.
Example - Order Paid to WhatsApp Receipt
- Shopify event:
orders/paid - Wexio connection: identifier
Email, path$.email - Flow: Webhook Received, then WA Template "order_receipt" with
{{webhook.order_number}},{{webhook.total_price}}and{{webhook.currency}}
Troubleshooting
| Symptom | Fix |
|---|---|
UNAUTHORIZED: HMAC signature mismatch | Double-check the signing key in Shopify. It is shop-wide, so one wrong copy breaks every webhook |
| Signature always mismatches after reaching Wexio | A reverse proxy is reformatting the JSON body. Shopify signs the exact bytes, so pass the body through untouched |
| Missing events | Confirm the webhook is registered for the event you expect in the Shopify admin |
Related
- Inbound Webhooks - auth modes, contact resolution and response codes
- Custom HMAC - how Generic HMAC SHA-256 verifies a request
- Webhook Received - the trigger that starts your flow
- Webhook History - check why a request failed