ShellOrbit / Shopify webhooks
A clearer delivery trail for Shopify.
Connect Shopify to ShellOrbit, verify incoming requests, and inspect delivery to your handler.
Create the endpoint
Create an endpoint in ShellOrbit and give it a name that identifies the provider and environment. Add your application’s public HTTPS handler as a destination.
Copy the ingest URL into Shopify’s webhook or notification configuration. Subscribe only to the event types your application needs.
Configure verification
In endpoint settings, choose Shopify and enter the appropriate Shopify app secret for webhook HMAC verification. Select Quarantine for invalid signatures, then save and enable verification.
Verification reads X-Shopify-Hmac-Sha256 and the original body. See the official Shopify verification instructions for provider-specific configuration.
Test delivery
Send a test event through the provider. Open Events in ShellOrbit, check the signature result, and inspect the destination’s response. Fix verification failures before enabling live traffic.
Verify forwarded requests
Your receiving handler should verify the fresh ShellOrbit signature. Original provider headers are useful evidence, but timestamped provider signatures may expire during retries and no longer match a transformed body.
Handle duplicate events
Use the provider’s event identifier in your application’s idempotency check. A transport failure or manual replay can deliver an event more than once.
Recover after an interruption
Inspect failed deliveries and use a recovery preview before starting a larger replay. Events that never reached ShellOrbit require recovery through the provider’s own tools; a relay cannot replay data it never received.
Start with one provider
Give your next webhook a clear destination.
Create an endpoint, connect your handler, and send a test event.