> ## Documentation Index
> Fetch the complete documentation index at: https://docs.sazabi.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Shopify Webhooks

> Send Shopify store and app webhooks to your Sazabi intake URL to search orders, refunds, products, and inventory changes as log records, with every delivery's signature verified.

[All Shopify integration capabilities](https://docs.sazabi.com/catalogs/integrations/shopify)

## About

Send Shopify webhooks to Sazabi to search orders, refunds, products, inventory, customers, and app uninstalls next to the rest of your production telemetry. Shopify posts each event to your Sazabi intake URL as a JSON `POST`, signed with an HMAC. There is no agent to deploy, and Sazabi never calls the Shopify API.

### What Sazabi records

Each Shopify delivery becomes one Sazabi record that keeps the full payload, timestamped when Sazabi receives it, so a retry a day or two later still lands. The original time is kept as an attribute. These attributes are extracted for filtering:

| Attribute | Source |
| - | - |
| `shopify.webhook.topic` | `X-Shopify-Topic` header |
| `shopify.webhook.id` | `X-Shopify-Webhook-Id` header |
| `shopify.webhook.event_id` | `X-Shopify-Event-Id` header |
| `shopify.webhook.triggered_at` | `X-Shopify-Triggered-At` header |
| `shopify.webhook.api_version` | `X-Shopify-API-Version` header |
| `shopify.shop.domain` | `X-Shopify-Shop-Domain` header |
| `shopify.resource.id` | `id` |
| `shopify.resource.admin_graphql_api_id` | `admin_graphql_api_id` |

## Prerequisites

* Access to **Settings > Notifications > Webhooks** in the Shopify admin, or to the Shopify app whose webhooks you configure.
* The key Shopify signs with: for an app's webhook, the app's client secret from the Shopify Dev Dashboard; for a webhook created in the admin, the ID Shopify says your webhooks are signed with, shown on the Webhooks page.
* Your Sazabi intake URL.

> [!NOTE]
>
> Signature verification is in early access. While it is on for your organization, Sazabi asks for the verification secret before it creates the intake URL, and rejects any delivery whose signature does not match. Contact support to turn it on.

## Set up in the dashboard

**Step 1**

### Add the log source

In the Sazabi dashboard, open **Settings > Log sources**, choose **Shopify Webhooks** and add it. If Sazabi asks for a verification secret, paste the key Shopify signs with (see the prerequisites above). Sazabi then shows your intake URL.

**Step 2**

### Create the webhook in Shopify

In the [Shopify admin](https://admin.shopify.com), open **Settings > Notifications > Webhooks** and click **Create webhook**.

* **Event**: Choose the topic to send, such as `Order creation`. Each webhook sends one topic, so create one per topic with the same URL.
* **Format**: **JSON**.
* **URL**: Paste your Sazabi intake URL.
* **Webhook API version**: Choose the latest stable version.

To subscribe an app instead, set the webhook subscription's `uri` to your Sazabi intake URL and deploy the app configuration.

**Step 3**

### Save and verify

Save the webhook, then click **Send test notification** to deliver a sample event.

## Set up with the CLI

You can also register the Shopify Webhooks log source with the [Sazabi CLI](https://docs.sazabi.com/reference/cli.md) (installed and authenticated — see [CLI reference](https://docs.sazabi.com/reference/cli/log-sources.md)).

```bash theme={"system"}
printf '%s' "$SHOPIFY_WEBHOOK_SECRET" | sazabi log-sources create shopify_webhooks --mode manual --verify-signatures shopify --secret-stdin
```

The command prints the intake URL. Paste it into the webhook's **URL** in Shopify. The secret is read from standard input, so it never appears in your shell history.

Run `sazabi log-sources get <log-source-id>` at any time to reprint the endpoint, or `sazabi log-sources list` to see every log source in the project.

## Verify signatures

Shopify signs every delivery with a base64 HMAC-SHA256 of the body and sends it in the `X-Shopify-Hmac-SHA256` header. Sazabi checks it on the exact bytes Shopify sent and rejects a delivery whose signature does not match with `401`. A rejected delivery is not stored and not billed. Shopify does not sign a timestamp, so Sazabi cannot tell a replayed delivery from a fresh one.

| Sender | Signature header | Secret | Setup |
| - | - | - | - |
| Shopify | `X-Shopify-Hmac-SHA256` | Shopify creates it; you paste it into Sazabi | Paste your Shopify app's client secret, from the app's settings in the Shopify Dev Dashboard. |

To change the secret later, open the log source in **Settings > Log sources** and choose **Rotate secret**. The previous secret keeps working for 24 hours by default, so Shopify keeps delivering while you update it. The [Intake page](https://docs.sazabi.com/guides/instrument/intake.md) shows rejected deliveries and why.

## Verify

Click **Send test notification** on the webhook, or create a draft order or update a product in a development store. Open the [Intake page](https://docs.sazabi.com/guides/instrument/intake.md) in the Sazabi dashboard and confirm records from the **Shopify Webhooks** source appear. Records typically arrive within a minute or two.

## Troubleshooting

**Shopify reports failed deliveries with `401`** — The signature did not match. An app's webhook is signed with the app's client secret; a webhook created in the admin is signed with an ID unique to your store. Check that the secret in Sazabi is the one that signs this webhook.

**`400` from Sazabi** — The body was not JSON. Choose **JSON** as the webhook format.

**No records after saving** — Confirm the URL exactly matches your Sazabi intake URL, including the `https://` scheme. Shopify removes a webhook after repeated failed deliveries, so check that it is still listed.

## Further reading

> [card] [Intake](https://docs.sazabi.com/guides/instrument/intake.md)
>
> See per-source ingestion volume and health in the Intake page.

> [card] [Webhook Events](https://docs.sazabi.com/catalogs/log-sources/send-to-an-endpoint/webhook-events.md)
>
> Verify signatures and send webhooks from any other platform.

> [card] [Verify webhook deliveries](https://shopify.dev/docs/apps/build/webhooks/verify-deliveries)
>
> Shopify's documentation for the signature Sazabi checks.

> [card] [Webhook topics](https://shopify.dev/docs/api/webhooks)
>
> Every topic Shopify can send.

> [card] [Log sources](https://docs.sazabi.com/catalogs/log-sources.md)
>
> Browse the full log source catalog.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.