Quick Answer
To automate Shopify webhooks: register a webhook URL in Shopify with the event you want (orders/create, fulfillments/update, etc.), build a workflow with HMAC verification, deduplication, and your downstream action (Sheets, Slack, internal API). Shopify retries aggressively — the Webhook Dedup node prevents duplicate runs.
Automate Shopify Webhooks — Free Workflow with HMAC + Dedup
Shopify emits webhooks for orders, fulfillments, products, customers — over 80 event types. This guide turns any of them into a free automated workflow that verifies signatures, deduplicates retries, and routes to wherever you want.
Why Shopify webhooks need special handling
- ▸Aggressive retries. Any non-2xx response triggers exponential retries for up to 48 hours. Your downstream system can see the same event many times.
- ▸HMAC-SHA256 in base64. Unlike GitHub (hex) or Stripe (custom format), Shopify uses base64 — easy to get wrong.
- ▸Tight timeout. Shopify expects a response within 5 seconds. Long downstream calls need to run async.
A workflow tool that ships HMAC verify and dedup as first-class nodes handles all three. Zapier and n8n require you to wire dedup yourself.
Step 1 — Generate a Requex webhook URL
Open requex.me. Copy the URL.
Step 2 — Register the webhook in Shopify
- Shopify admin → Settings → Notifications → scroll to Webhooks.
- Click Create webhook.
- Event: pick your event (e.g.
Order creation). - Format:
JSON. - URL: paste your Requex URL.
- Save. Shopify shows the signing secret — copy it.
Step 3 — Build the verify + dedup workflow
In Requex → Workflows, add these nodes in order:
- Webhook Verify — paste the Shopify signing secret. Algorithm: HMAC-SHA256. Encoding: base64. Header:
X-Shopify-Hmac-SHA256. - Webhook Dedup — key on the Shopify event ID header:
{{ headers["x-shopify-webhook-id"] }}. TTL: 24 hours. This silently drops retries that already succeeded. - Your downstream action. Common picks: Google Sheets (append row), Slack (post message), HTTP (POST to your internal API). Add as many as you like — Requex does not meter nodes.
Step 4 — Test it
Place a test order in Shopify (or use the Send test notification button in the webhook config). Within seconds the workflow run appears in Requex with a trace per node. Check the verify node passed; check the dedup node logs the event ID.
Send the test notification twice. The second run shows the Dedup node short-circuiting — no duplicate downstream call.
Common pitfalls
- •Encoding confusion. Shopify uses base64. Tools that default to hex (because they were written for GitHub) silently fail.
- •JSON re-parsing breaks HMAC. The signature covers the raw bytes. Tools that parse-then-stringify before verify produce a different byte string. Requex preserves the raw body.
- •Slow downstream. If your workflow takes more than 5s, Shopify treats it as a failure and retries. Put long work behind an async branch — Requex returns 200 to Shopify as soon as the workflow begins.
Skip the wiring — use the template
The Shopify → Google Sheets template ships HMAC verify, dedup, and a Sheets append node pre-wired. Paste your secret, pick a sheet, you are done.
Open the Shopify → Sheets template →