Changelog

Flow Webhooks is now Workflow Webhooks. Same app, same install, same webhooks - new name, matching the rest of our Workflow range.

• New documentation site at docs.workflow-webhooks.app, with the full n8n, Make and Zapier walkthroughs including video guides.
• New Help Center - report a bug, request a feature, or contact us through a proper form that reaches us directly, with screenshots attached.
• In-app chat - the chat bubble is now on every page of the app, and it politely gets out of the way when a dialog is open.
• Setup guide on the dashboard, walking you from your first webhook through to a working Shopify Flow workflow. It remembers whether you collapsed it.

Routine security maintenance: dependency updates and hardening across the app. No action needed.

• Email notifications - get warned as you approach your plan limit, when you hit it, and when your webhooks start failing more than usual. Add extra recipients beyond the store owner, each with their own unsubscribe link.
• HMAC signature presets - match the signing scheme of common senders without hand-rolling the format.
• Opt in to more request data - choose per webhook whether to pass request headers, query-string parameters and the raw request body through to Flow.
• Search invocation history by payload content.

Sidekick can now answer questions about this app directly. Ask things like "do I have a webhook for my contact form", "is my n8n webhook enabled", "how many times did it fire this week" or "why did my last invocation fail".

Read-only - Sidekick can look at your webhooks, history and usage, but cannot change anything.

Workflow Webhooks now runs on a new European cloud platform. Nothing changes in how you use it, but underneath:

• Webhook processing moved to a managed queue with dead-letter handling, so a call is never silently dropped.
• Databases and caches are region-local in the EU, with encryption at rest.
• Merchant secrets - your static tokens and HMAC keys - are now encrypted with a dedicated key management service, not just stored encrypted at the disk level.
• Redundant instances across availability zones.

The result is lower latency on webhook reception and far better behaviour under load.

• Custom static-token header - the token header no longer has to be X-Api-Key. Set your own name per webhook in Advanced Settings to match whatever the sending system already sends. Reserved and proxy-controlled header names are rejected for safety.
• Automatic session refresh - access tokens are now refreshed in the background, so long-running stores no longer see deliveries fail after a token expires.
• Smarter retries - failed deliveries retry with backoff, and permanent failures stop retrying immediately instead of burning through attempts.

• Added database indexes that speed up history and statistics queries on busy stores.
• Added real-user performance monitoring so we catch slow pages in the admin.
• Security pass across the app: dependency updates and removal of unsafe HTML rendering.

• Rebuilt the dashboard around metric cards, a date range picker and an invocations chart.
• Unsaved changes are now protected. Editing a webhook shows Shopify's save bar, and switching tabs or hitting back with pending edits prompts you first instead of quietly discarding them.

Reindexed webhook history. Stores with large invocation volumes will notice the history page and dashboard loading considerably faster.

• Replay - open any past invocation and send it again with one click. This is the fastest way to wire up a Flow workflow: record events in Flow, then replay a real call instead of re-triggering the source system.
• Webhook templates - preconfigured starting points for n8n, Make, Zapier, contact forms and custom integrations.

• Fixed an authentication edge case that could reject valid requests.
• Fixed proxy path resolution so app proxy URLs route correctly.
• Corrected a display error on the webhook list.

• Flow action - the reverse direction. A Shopify Flow workflow can now call a webhook as an action step, so Flow can push data out as well as be triggered by it.
• Dashboard statistics - invocation totals, success rate and a chart over your selected date range.
• Invocation source tracking - history now records whether a call came from Flow, a test, curl or an external system, and you can filter on it.

Shopify Flow variables are flat strings, so nested objects and arrays used to arrive unusable.

Values that are objects or arrays are now detected automatically and passed to Flow as JSON strings, so nothing is silently lost on the way in.

Introduced subscription plans with a monthly invocation allowance, and usage tracking on the dashboard so you can see where you stand against your limit.

Every plan includes all authentication methods, field mapping, CORS, history and replay - plans differ only in monthly volume.

• App proxy endpoint - each webhook can now also be reached through a Shopify app proxy URL, which avoids cross-origin problems for browser-based callers.
• Date range filter on the history page, so you can narrow down to the day something went wrong instead of scrolling.

Four mapped fields are not always enough. Turn on Allow Custom Request Body under a webhook's Security settings and the entire incoming payload is passed through to Shopify Flow, on top of the four named fields.

Useful when the sending system's payload shape is not yours to control.

• Webhook configuration is now cached, so receiving a call does less work and responds faster.
• Disabled webhooks are clearly badged in the list, so it is obvious at a glance why one is not firing.
• Reworked the webhook detail page, plus a batch of smaller fixes.

The first release. Shopify Flow only reacts to events inside Shopify - this removes that limit.

• Webhook endpoints - every webhook gets its own secure URL that any external system can POST to.
• Three authentication modes - None for testing, a static token in the X-Api-Key header, or HMAC SHA256 for tamper-proof signing.
• Payload mapping - map up to four fields out of the incoming JSON and use them in Flow as {{fieldOne}} to {{fieldFour}}.
• Invocation history - every call is logged with its headers, payload, status and timing.
• CORS support - switch it on to accept calls straight from a browser or storefront form.
• Webhook dashboard - create, enable, disable and bulk-manage every endpoint in one place, with a one-click token generator.