Changelog

Until now a webhook could only acknowledge a request - your Shopify Flow workflow ran afterwards, and the caller never heard the outcome. Synchronous response changes that: the app holds the request open until your workflow sends data back, and returns it to the caller.

Useful whenever the caller needs an answer rather than a receipt - a form that shows a result, a system waiting on a computed value, a lookup.

How it works

Switch on Synchronous response under Advanced Settings on the webhook. Then build the workflow on the new Sync Webhook Trigger, and finish it with the new Return Webhook Response action.

Write the response body straight into the action using the trigger's variables:

{"ok": true, "orderId": "{{fieldOne}}", "email": "{{fieldTwo}}"}

or build something more involved in a Run Code action and bind the result.

Typical round trip is two to four seconds. If your workflow does not answer within 15 seconds the caller simply gets the normal response instead - never an error, and never a hang.

Full guide: Synchronous response

Nothing changes unless you switch it on

Off by default on every webhook. Existing webhooks keep answering immediately and keep using the standard Webhook Trigger, exactly as before.

The REST API and MCP server now have a permanent home of their own:

https://shopify.workflow-webhooks.app

So the API is at https://shopify.workflow-webhooks.app/api/v1 and the MCP server at https://shopify.workflow-webhooks.app/api/mcp. Both are shown with a copy button on the Developer page.

Previously these lived on the app's embedded URL. Splitting them out means the address you paste into a script, a CI job or an AI assistant is stable and unrelated to how the app is embedded in your admin. The new hostname serves the API only - the app itself stays where it was, and nothing you have already set up needs changing.

Much more documentation

Nine new pages are live at docs.workflow-webhooks.app:

• Create your first webhook - end to end, including wiring up the Shopify Flow side
• Authentication - static token, HMAC, and presets for Stripe, GitHub, Shopify, Slack, Typeform and Calendly
• Payload mapping and Flow variables - dot paths, nested values, and what to do when four fields are not enough
• Duplicate delivery protection
• History and troubleshooting - every rejection code and what to do about it
• Calling a webhook from Flow
• Plans and usage - what counts toward your limit and what does not
• Sidekick and AI assistants
• Frequently asked questions

The Developer API and MCP guide is published too.

Most systems retry a webhook if they don't get a quick reply. If the first attempt actually arrived, your Shopify Flow workflow runs twice for the same event - a second email, a second tag, a duplicate order note.

Duplicate delivery protection fixes that. If your sending system includes a unique id per event, tell us which header carries it and we ignore the repeats.

Set it under Advanced Settings -> Duplicate delivery on any webhook. Type the header name your sender uses - commonly Event-Id, Idempotency-Key or X-Request-Id.

• The first request with a given id runs normally.
• Any repeat within 24 hours gets a normal 200 OK response, so the sender stops retrying - but it is not sent to Flow again.
• Suppressed duplicates don't count toward your plan limit.
• You can still see them: the Live Request Inspector shows the request and labels it as a suppressed duplicate, so it never looks like the call vanished.

Leave the field empty and nothing changes - every request is processed, exactly as before. This is off by default on all existing webhooks.

Manage your webhooks from your own code, or from an AI assistant like Claude or Cursor.

• New Developer page: create scoped API keys and get copy-ready connect commands for Claude Code, Claude Desktop, Cursor, VS Code, Gemini CLI and OpenAI Codex.
• REST API at /api/v1 - list and manage webhooks, read invocation history and stats, list templates.
• MCP server at /api/mcp, so an AI assistant can do the same in conversation.
• Three access levels. Read keys can only look. Write keys can also create, update and delete webhooks. Execute keys can additionally fire a test invocation or replay a past one - which really does run your Shopify Flow workflows.
• Your data stays protected. A webhook's auth token is never readable back through the API, and personal data in request payloads (email addresses, phone numbers, names, card numbers) is masked before it leaves the server.

Flow Webhooks is now Workflow Webhooks. Same app, same install, same webhooks - new name, matching the rest of our Workflow range.

• New documentation site at docs.workflow-webhooks.app, with the full n8n, Make and Zapier walkthroughs including video guides.
• New Help Center - report a bug, request a feature, or contact us through a proper form that reaches us directly, with screenshots attached.
• In-app chat - the chat bubble is now on every page of the app, and it politely gets out of the way when a dialog is open.
• Setup guide on the dashboard, walking you from your first webhook through to a working Shopify Flow workflow. It remembers whether you collapsed it.

Routine security maintenance: dependency updates and hardening across the app. No action needed.

• Email notifications - get warned as you approach your plan limit, when you hit it, and when your webhooks start failing more than usual. Add extra recipients beyond the store owner, each with their own unsubscribe link.
• HMAC signature presets - match the signing scheme of common senders without hand-rolling the format.
• Opt in to more request data - choose per webhook whether to pass request headers, query-string parameters and the raw request body through to Flow.
• Search invocation history by payload content.

Sidekick can now answer questions about this app directly. Ask things like "do I have a webhook for my contact form", "is my n8n webhook enabled", "how many times did it fire this week" or "why did my last invocation fail".

Read-only - Sidekick can look at your webhooks, their configuration and their invocation history, but cannot change anything.

Workflow Webhooks now runs on a new European cloud platform. Nothing changes in how you use it, but underneath:

• Webhook processing moved to a managed queue with dead-letter handling, so a call is never silently dropped.
• Databases and caches are region-local in the EU, with encryption at rest.
• Merchant secrets - your static tokens and HMAC keys - are now encrypted with a dedicated key management service, not just stored encrypted at the disk level.
• Redundant instances across availability zones.

The result is lower latency on webhook reception and far better behaviour under load.

• Custom static-token header - the token header no longer has to be X-Api-Key. Set your own name per webhook in Advanced Settings to match whatever the sending system already sends. Reserved and proxy-controlled header names are rejected for safety.
• Automatic session refresh - access tokens are now refreshed in the background, so long-running stores no longer see deliveries fail after a token expires.
• Smarter retries - failed deliveries retry with backoff, and permanent failures stop retrying immediately instead of burning through attempts.

• Added database indexes that speed up history and statistics queries on busy stores.
• Added real-user performance monitoring so we catch slow pages in the admin.
• Security pass across the app: dependency updates and removal of unsafe HTML rendering.

• Rebuilt the dashboard around metric cards, a date range picker and an invocations chart.
• Unsaved changes are now protected. Editing a webhook shows Shopify's save bar, and switching tabs or hitting back with pending edits prompts you first instead of quietly discarding them.

Reindexed webhook history. Stores with large invocation volumes will notice the history page and dashboard loading considerably faster.

• Replay - open any past invocation and send it again with one click. This is the fastest way to wire up a Flow workflow: record events in Flow, then replay a real call instead of re-triggering the source system.
• Webhook templates - preconfigured starting points for n8n, Make, Zapier, contact forms and custom integrations.

• Fixed an authentication edge case that could reject valid requests.
• Fixed proxy path resolution so app proxy URLs route correctly.
• Corrected a display error on the webhook list.

• Flow action - the reverse direction. A Shopify Flow workflow can now call a webhook as an action step, so Flow can push data out as well as be triggered by it.
• Dashboard statistics - invocation totals, success rate and a chart over your selected date range.
• Invocation source tracking - history now records whether a call came from Flow, a test, curl or an external system, and you can filter on it.

Shopify Flow variables are flat strings, so nested objects and arrays used to arrive unusable.

Values that are objects or arrays are now detected automatically and passed to Flow as JSON strings, so nothing is silently lost on the way in.

Introduced subscription plans with a monthly invocation allowance, and usage tracking on the dashboard so you can see where you stand against your limit.

Every plan includes all authentication methods, field mapping, CORS, history and replay - plans differ only in monthly volume.

• App proxy endpoint - each webhook can now also be reached through a Shopify app proxy URL, which avoids cross-origin problems for browser-based callers.
• Date range filter on the history page, so you can narrow down to the day something went wrong instead of scrolling.

Four mapped fields are not always enough. Turn on Allow Custom Request Body under a webhook's Security settings and the entire incoming payload is passed through to Shopify Flow, on top of the four named fields.

Useful when the sending system's payload shape is not yours to control.

• Webhook configuration is now cached, so receiving a call does less work and responds faster.
• Disabled webhooks are clearly badged in the list, so it is obvious at a glance why one is not firing.
• Reworked the webhook detail page, plus a batch of smaller fixes.

The first release. Shopify Flow only reacts to events inside Shopify - this removes that limit.

• Webhook endpoints - every webhook gets its own secure URL that any external system can POST to.
• Three authentication modes - None for testing, a static token in the X-Api-Key header, or HMAC SHA256 for tamper-proof signing.
• Payload mapping - map up to four fields out of the incoming JSON and use them in Flow as {{fieldOne}} to {{fieldFour}}.
• Invocation history - every call is logged with its headers, payload, status and timing.
• CORS support - switch it on to accept calls straight from a browser or storefront form.
• Webhook dashboard - create, enable, disable and bulk-manage every endpoint in one place, with a one-click token generator.