---
title: "Workflow Webhooks FAQ"
description: "Common questions about webhooks, Shopify Flow, duplicate runs, plan limits, CORS and payload data."
canonical: "https://docs.workflow-webhooks.app/faq"
---

# Frequently asked questions

## Do I need Shopify Flow?

Yes. Flow is what runs your automation; this app is the bridge that lets an outside system
start it. Flow is free from Shopify.

## Can one webhook drive several workflows?

Yes. Every Webhook Trigger workflow receives events from all your webhooks, so add a
condition on **Webhook ID** in each workflow to pick the one it should respond to.

## Why did my workflow run twice?

Either two workflows use the Webhook Trigger without distinct Webhook ID conditions, or
your sender retried. **History** tells you which - two entries means two requests actually
arrived. See [Duplicate delivery protection](https://docs.workflow-webhooks.app/duplicate-delivery.md).

## Why is my request rejected with "mapping field missing"?

A field you mapped is not present in the payload. Either send it, or unmap it in Advanced
Settings. Full code list in [History and troubleshooting](https://docs.workflow-webhooks.app/history-and-troubleshooting.md).

## Can I send more than four fields?

Yes - turn on **Use whole body** to pass the entire payload to Flow as a JSON string
alongside the four mapped fields. See [Payload mapping and Flow variables](https://docs.workflow-webhooks.app/payload-mapping.md).

## Can I call the webhook from a browser?

Yes, enable **CORS** on the webhook. Bear in mind anything in browser JavaScript is public,
so do not put a static token in front-end code - use a webhook with no token, or proxy the
call through your own backend.

## Is my payload data stored?

Yes, in invocation history, so you can debug and replay. Sensitive header values are
masked. Data returned through our REST API and MCP server is additionally PII-masked - see
[Developer API and MCP](https://docs.workflow-webhooks.app/developer-api-and-mcp.md).

## Can I change the header my token is sent in?

Yes - **Auth header name** in Advanced Settings. Defaults to `X-Api-Key`. See
[Authentication](https://docs.workflow-webhooks.app/authentication.md).

## What happens if I hit my plan limit?

Further requests are rejected with `quota_exceeded` until the rolling 30-day window drops
below the limit. See [Plans and usage](https://docs.workflow-webhooks.app/plans-and-usage.md).

## Do rejected requests count toward my plan?

No. Only accepted invocations count. Tests, replays and suppressed duplicates do not
either.

## Can I replay an old event?

Yes, from the invocation's detail page. Useful for building a workflow, or re-running
events that arrived while a workflow was broken.

## How do I move a webhook to another store?

Webhooks are per store. Recreate it on the other store - it gets its own URL and token. The
**Export** button on the webhook page gives you its configuration to copy from.