K

Shopify Webhook Setup

Step-by-step instructions for creating and configuring Shopify webhooks for real-time order tracking.

Emil Klitmose

Written by Emil Klitmose

Updated recently

Webhooks are how Shopify notifies Revshare when an order is paid. This enables real-time tracking of affiliate sales without any delay.

This guide walks you through creating and configuring the webhook in your Shopify admin.

  • Real-time order notifications
  • Secure verification with signing secrets
  • Automatic retry on failures
  • Works with all Shopify plans

What Are Webhooks?

Webhooks are automated messages sent from Shopify to Revshare when specific events happen. For affiliate tracking, we use the Order payment event.

When a customer completes payment for an order, Shopify immediately sends the order details to Revshare. We then check if the order came from an affiliate link and calculate the commission.

This is more reliable than polling or manual updates because the data arrives instantly and automatically.

Creating the Webhook

Follow these steps to create the webhook in Shopify:

1. Navigate to Notifications

In your Shopify Admin, go to Settings (bottom left) → Notifications.

2. Find the Webhooks Section

Scroll down to the bottom of the page. You'll see a section labeled Webhooks.

3. Create a New Webhook

Click Create webhook to open the webhook creation form.

4. Configure the Webhook

Set the following values:

  • Event: Order payment
  • Format: JSON
  • URL: https://www.revshare.so/api/shopify/webhook
  • Webhook API version: Leave as default (latest)

5. Save the Webhook

Click Save to create the webhook.

Webhook URL to Copy:

https://www.revshare.so/api/shopify/webhook

The Signing Secret

After creating your first webhook, Shopify displays a Signing secret at the top of the webhooks section. This secret is crucial for security.

The signing secret allows Revshare to verify that incoming webhooks are genuinely from Shopify and haven't been tampered with.

Important: Copy the signing secret immediately after creating your webhook. Shopify only shows it once in full. If you lose it, you can reveal it again from the webhooks section.

To save your signing secret in Revshare:

  1. Copy the secret from Shopify (starts with shpss_)
  2. Go to your Revshare program's Shopify setup page
  3. Paste the secret in the Webhook signing secret field
  4. Click Save

Webhook Verification

Every webhook Shopify sends includes a signature in the X-Shopify-Hmac-SHA256 header. Revshare uses this signature along with your signing secret to verify authenticity.

If verification fails, the webhook is rejected and the order won't be processed. This protects against:

  • Fake orders from malicious actors
  • Tampered data during transmission
  • Replay attacks using old webhook data

Technical note: Verification uses HMAC-SHA256 to create a hash of the request body using your secret key. If the computed hash matches the header signature, the webhook is authentic.

Common Issues

Webhook not triggering

  • Ensure the event is set to Order payment, not just Order creation
  • Test with a real payment (test orders may not trigger payment webhooks)
  • Check if your store has other apps that might interfere

Verification errors

  • Double-check the signing secret has no extra spaces
  • Make sure you're using the correct secret (each store has one)
  • Try re-copying the secret from Shopify

Orders not appearing in Revshare

  • Verify the webhook URL is exactly https://www.revshare.so/api/shopify/webhook
  • Check that the order had an affiliate tracking cookie
  • Ensure the tracking script is installed on your store

Need more help? See our complete Shopify Integration Guide or contact support.