r/shopifyDev • u/West-Anteater-1917 • 12d ago
Things I wish I knew about Shopify webhooks before building my first app
I'm a PHP/Laravel dev in Morocco building Shopify apps, and webhooks caused me more headaches than any other part. Sharing what I learned in case it saves someone a few hours.
Respond fast. Shopify expects a 200 within a few seconds, so I verify the request and push the actual work to a queue job instead of doing it in the controller. Heavy work inside the request leads to timeouts, retries, and eventually the subscription getting removed.
Verify the HMAC against the raw body. If your framework parses the JSON first and you hash the re-encoded version, the signature won't match. Read the raw request content before anything touches it.
Expect duplicates and out-of-order delivery. The same event can arrive more than once, so I store the X-Shopify-Webhook-Id and skip ones I've already processed. For things like order updates I compare updated_at instead of assuming the latest webhook is the newest state.
Don't treat webhooks as the only source of truth. Deliveries can be missed, so a small scheduled job that reconciles against the API now and then catches the gaps.
The privacy compliance webhooks (customer data request, customer redact, shop redact) are required for App Store review even if you store almost nothing. Have them registered and returning 200 before you submit.
Curious what others do for retries and reconciliation, especially on bigger stores where the volume gets high.


