Shopify's webhooks are well documented and cover the whole order lifecycle, so the technical side of this is straightforward. The interesting decisions are all about restraint.
The transactional messages, which work
| Webhook | Message | Effect |
|---|---|---|
| orders/create | Order confirmed, with what and when | Reduces "did my order go through" contacts |
| fulfillments/create | Shipped, with tracking | The single highest-value message here |
| Delivery exception | Something went wrong, and what you are doing | Turns a bad experience into a recovered one |
| orders/cancelled | Confirmation plus refund timing | Refund timing is the actual question |
The shipping notification is the one that pays for the integration. It is the message customers most want, it arrives at full quality with a real link, and it measurably reduces "where is my order" support volume.
The marketing messages, which are a trap
Abandoned cart is where stores lose this channel
It converts, which is exactly why it is dangerous. A cart reminder in the same thread as someone's family reads as surveillance rather than service, and the opt-out and block rate is much higher than in email. A blocked recipient is gone permanently and counts against your line's health. If you run it at all, run it once, hours not minutes after abandonment, and never twice.
The general rule for ecommerce on this channel: message about things the customer initiated. An order they placed is theirs. A cart they abandoned is arguably theirs. A promotion is yours. Where email still wins.
Consent at checkout
A phone number entered for delivery purposes is not consent to marketing. If you want to send anything beyond transactional updates you need a separate, unbundled opt-in — a checkbox that is not pre-ticked, with clear language about what they will receive.
Keep transactional and marketing consent as two different fields, and check the right one per message type. Conflating them is the mistake that turns a shipping notification programme into a compliance problem. What holds up.
Implementation notes
- Verify the Shopify HMAC over the raw request body before parsing. Same rule as every webhook.
- Deduplicate on the webhook ID. Shopify retries, and a duplicated shipping notification is a bad look.
- Do not send on every fulfilment event for a split shipment, or a three-parcel order becomes three messages.
- Include the actual tracking link, not a link to a portal that then asks for an order number.
Launch order
- Shipping notification only, to start.
- Transactional consent recorded separately from marketing.
- Webhook signature verified; events deduplicated.
- Split shipments collapsed into one message where sensible.
- Support volume measured before and after — that is the ROI number.