Shopify Webhooks: Send Store Events to Sazabi

Last verified on Nov 8, 2026.

Shopify webhooks tell another system when something changes in a store: an order is placed, a product is edited, a customer signs up. This page covers what Shopify sends, how to point it at Sazabi and what to check when deliveries stop arriving.

What Shopify sends

Each event is a topic written as resource/action. The webhooks reference lists topics such as orders/create, orders/paid, orders/fulfilled, refunds/create, products/create, products/update, products/delete, customers/create and app/uninstalled.

For HTTPS endpoints Shopify sends an HTTP POST with a JSON body. By default the body is the full resource for the topic, and you can trim it with include_fields on a subscription. The topic, the shop domain and a delivery ID travel in headers such as X-Shopify-Topic and X-Shopify-Shop-Domain, not in the JSON.

Why send them to Sazabi

Sazabi's Shopify Webhooks source stores each delivery as a searchable log record. That puts order and product changes next to your application logs, so a drop in checkout traffic and the order events around it live in one place.

The topic isn't in the body, so the source reads it from the header. Each record carries shopify.webhook.topic, shopify.shop.domain and shopify.webhook.id, and the resource id as shopify.resource.id. One webhook per topic with the same URL is enough to keep orders/create and orders/paid apart.

Sazabi's Webhook Events source does the same job for platforms that have no source of their own.

Sazabi accepts only JSON. Pick the JSON format wherever Shopify asks.

Set it up in Shopify

You can create a webhook in the Shopify admin or in an app.

First add the Shopify Webhooks source in Sazabi and copy the intake URL it shows.

1. In the admin, go to Settings, then Notifications, then Webhooks.
2. Select Create webhook and choose an event. You can't change the event after you save.
3. Set Format to JSON.
4. Paste your Sazabi intake URL from the Shopify Webhooks source.
5. Choose a webhook API version and save.

The admin creates one webhook per event, so repeat the steps per topic. If you manage subscriptions in an app, add a [[webhooks.subscriptions]] block with topics and a uri in your app configuration file, or call the webhookSubscriptionCreate mutation.

To test, create an order in a development store. The shopify app webhook trigger command sends a synthetic event to an address you give it. It doesn't test your subscription itself.

Example payload

This is an abbreviated products/update body, using field names from the Shopify docs. It is an example, not a captured delivery.

{
  "id": 9554194432293,
  "title": "T-Shirt",
  "status": "active",
  "vendor": "My Store",
  "updated_at": "2025-04-22T14:30:00-05:00",
  "variants": [{ "id": 123456789, "title": "Default Title", "price": "29.99", "sku": "TSHIRT-001" }]
}

In a Sazabi thread, search for a value from the payload, such as a product's id, or filter on shopify.resource.id, to find every change to one product.

What to watch for

• Failed deliveries. Shopify treats anything outside the 200 range, including a redirect, as an error. It allows one second to connect and five seconds for the whole request.
• Removed subscriptions. After repeated failures Shopify removes the subscription. A gap in event volume that never closes usually means the subscription is gone.
• Duplicates. Shopify can deliver the same webhook more than once, for example after a timeout. The delivery ID is a header, so plan on body fields such as the resource id and updated_at to spot repeats.
• Delays. Retries can leave data out of sync. Shopify says to compare the webhook timestamp with the current time if late deliveries would cause problems.
• Personal data. Order and customer payloads carry names, emails and addresses. Use include_fields to send only what you need to search.

The Intake page in the Sazabi dashboard shows ingestion volume per source. Compare it with the order counts you expect from Shopify.

Retries and signing

When your endpoint fails to answer with a 200-series status, Shopify retries up to eight times over four hours. Shopify signs HTTPS deliveries with the X-Shopify-Hmac-SHA256 header, a base64 HMAC-SHA256 of the body made with your app's client secret, or for a webhook created in the admin, the ID Shopify shows on its webhooks page.

If you also take payments or subscriptions outside Shopify, the same setup works for Chargebee events. Email delivery events from your store's mail provider can arrive the same way from SendGrid.