Shopify API Integrations: Complete Guide

Shopify API Architecture: REST vs GraphQL

Shopify provides two APIs: REST (resource-based, simpler) and GraphQL (query-based, flexible). The REST API is mature and widely documented. GraphQL is newer, optimizes queries, and handles complex bulk operations better.

REST API: Simple for CRUD operations. Request `/admin/api/2024-01/orders.json` to fetch orders. Good for straightforward integrations.

GraphQL API: Powerful for complex queries. Write a query that fetches orders with related fulfillments, line items, and inventory in one request. Better for high-volume data needs.

Five Key Integration Scenarios

Testing Shopify Webhooks with Requex

Before deploying your webhook handler to production, test with a temporary endpoint:

1. Visit Requex.me and copy your webhook URL.
2. In Shopify Admin, go to Settings → Notifications → Webhooks → Create webhook.
3. Select event (e.g., "Order created"), paste Requex URL, click Create.
4. Shopify provides a "Send test notification" button. Click it to see sample payload.
5. Inspect the payload in Requex dashboard. Verify headers, signature, and event structure.

Requex lets you test HMAC verification, payload parsing, and error responses without a deployed server.

Common Shopify Webhook Testing Pain Points

Shopify HMAC Signature Verification

Always verify the webhook signature to ensure it came from Shopify:

// Node.js / Express example
const crypto = require('crypto');

app.post('/webhook', express.json({ verify: (req, res, buf) => {
    req.rawBody = buf;
}}), (req, res) => {
    const hmacHeader = req.headers['x-shopify-hmac-sha256'];
    const secret = process.env.SHOPIFY_WEBHOOK_SECRET;

    const hash = crypto
        .createHmac('sha256', secret)
        .update(req.rawBody)
        .digest('base64');

    if (!crypto.timingSafeEqual(Buffer.from(hmacHeader), Buffer.from(hash))) {
        return res.status(401).json({ error: 'Invalid HMAC' });
    }

    const payload = JSON.parse(req.rawBody);
    // Process webhook...
    res.status(200).send('ok');
});