Workflow WebhooksWorkflow Webhooks

How to connect Svix to Shopify Flow

Svix is the webhook infrastructure behind Clerk, Resend, Superwall and many other products. If your sender delivers through Svix, this preset verifies it. Workflow Webhooks turns that call into a Shopify Flow trigger, so your store can react to it: tag a customer, add an order note, send an internal email, update a metafield - anything Shopify Flow can do.

This guide sets up the whole path - Svix sends, Workflow Webhooks receives and verifies, Shopify Flow acts - with Svix's HMAC signature checked on every request, so nothing but Svix can start your workflow.

What you can build

  • Tag a Shopify customer when Clerk reports that they signed up or verified their email in your app.
  • React to a Resend delivery or bounce event and flag the customer whose address is failing.
  • Receive from any Svix-powered product without configuring a custom signature.

Typical events to send: any event the sending service defines.

The same preset also verifies webhooks from Clerk, Resend, Superwall.

Before you begin

  • Workflow Webhooks installed on your Shopify store.
  • Shopify Flow installed, which is free from the Shopify App Store.
  • An account on Svix with permission to create webhooks.

Step 1 - Create the webhook in Workflow Webhooks

  1. Open Workflow Webhooks -> Webhooks -> Create webhook and give it a name you will recognise in Flow, such as Svix events.
  2. Under Authentication, choose HMAC.
  3. Under Signature provider, pick Svix. The app fills in the header, algorithm, signed payload and replay window for you - there is nothing else to configure.
  4. Leave the secret empty for now and Save. Copy the webhook URL shown on the page.

See Authentication for the other authentication modes, and Payload mapping and Flow variables for choosing which fields reach Flow.

Step 2 - Add the endpoint in Svix

Add the URL as the endpoint in the sending service's webhook settings, then reveal and copy its signing secret (it starts with whsec_).

How to find your Svix signing secret

The endpoint signing secret starting with whsec_, from the webhook settings of the service.

Svix's own documentation on webhook signatures has the exact wording and screenshots for your account.

Paste that secret into the webhook's Secret field in Workflow Webhooks and save. From that moment every Svix delivery is verified before it reaches Flow.

What this checks

What Value
Signature header svix-signature
Where the signature sits The header value, after the prefix v1,
What is signed {header:svix-id}.{timestamp}.{body}
Signature HMAC-SHA256, base64 encoded
Timestamp The svix-timestamp header, as Unix seconds
Replay protection Requests whose signed timestamp is more than 5 minutes away from now are rejected
The secret Base64-decoded before use. The leading whsec_ is stripped before decoding. Paste it exactly as the sender shows it

In the signed payload, {body} is the raw request body, byte for byte, and {timestamp} is the timestamp above, and {header:svix-id} is the svix-id request header.

A request that fails any of these is rejected with 401, is recorded in History and troubleshooting, and never starts a workflow.

Step 3 - Build the Shopify Flow workflow

  1. In Shopify Flow, create a workflow and choose the Workflow Webhooks trigger.
  2. Press Record events, then send a test event from Svix (or use Send test in Workflow Webhooks) so Flow learns the shape of your data.
  3. Every webhook you own fires the same Flow trigger, so add a first condition on the webhook id to keep this workflow to Svix only. The id is shown on the webhook page.
  4. Add your actions - tag a customer, add a note, send an internal email, update a metafield.

Step 4 - Test it end to end

Trigger a real event in Svix. In Workflow Webhooks -> History you should see the invocation with status Success. If the signature was wrong you get a failed entry with the reason instead, and Verifying signed webhooks explains the signature tester that shows you exactly which step failed.

The signature does not match▾

In this order: the secret (the most common cause - an extra space, or a key from the wrong environment), whether the sender is using a different endpoint's secret, and whether anything between Svix and the app rewrites the body. Signatures cover the raw bytes, so a proxy that re-formats JSON breaks them. The signature tester on the webhook page shows the exact text that was signed.

I get 401 on every request▾

Check that the webhook's authentication is set to HMAC with the Svix provider selected, that the secret is filled in, and that Svix is posting to the URL exactly as the app shows it, including the code at the end.

Nothing appears in History▾

The request never arrived. Re-check the URL in Svix, and look at Svix's own delivery log for the response it got. A 404 means a wrong or deleted webhook, a 429 means you are over your plan's invocation limit - see Plans and usage.

The workflow runs for the wrong events▾

Every webhook in your store fires the same Flow trigger. Add a condition on the webhook id as the first step of the workflow, or narrow the events you send from Svix.

Requests fail with "timestamp outside tolerance"▾

Svix signs a timestamp and the app rejects anything more than 5 minutes old. This is normally a clock problem on the sending side, or a delivery that Svix retried much later with the original timestamp. Retries from the same original request cannot pass; ask Svix to send a fresh event.