--- title: "Connect Svix webhooks to Shopify Flow - Workflow Webhooks" description: "Send Svix webhooks into Shopify Flow. Step-by-step setup with Svix's HMAC signature verified on every request, plus what the app checks and how to troubleshoot." canonical: "https://docs.workflow-webhooks.app/how-to-connect-svix" --- # How to connect Svix to Shopify Flow Svix is the webhook infrastructure behind Clerk, Resend, Superwall and many other products. If your sender delivers through Svix, this preset verifies it. **Workflow Webhooks** turns that call into a **Shopify Flow trigger**, so your store can react to it: tag a customer, add an order note, send an internal email, update a metafield - anything Shopify Flow can do. This guide sets up the whole path - Svix sends, Workflow Webhooks receives and verifies, Shopify Flow acts - with Svix's HMAC signature checked on every request, so nothing but Svix can start your workflow. ## What you can build - Tag a Shopify customer when Clerk reports that they signed up or verified their email in your app. - React to a Resend delivery or bounce event and flag the customer whose address is failing. - Receive from any Svix-powered product without configuring a custom signature. Typical events to send: any event the sending service defines. The same preset also verifies webhooks from Clerk, Resend, Superwall. ## Before you begin - **Workflow Webhooks** installed on your Shopify store. - **Shopify Flow** installed, which is free from the Shopify App Store. - An account on Svix with permission to create webhooks. ## Step 1 - Create the webhook in Workflow Webhooks 1. Open **Workflow Webhooks -> Webhooks -> Create webhook** and give it a name you will recognise in Flow, such as `Svix events`. 2. Under **Authentication**, choose **HMAC**. 3. Under **Signature provider**, pick **Svix**. The app fills in the header, algorithm, signed payload and replay window for you - there is nothing else to configure. 4. Leave the secret empty for now and **Save**. Copy the webhook URL shown on the page. See [Authentication](https://docs.workflow-webhooks.app/authentication.md) for the other authentication modes, and [Payload mapping and Flow variables](https://docs.workflow-webhooks.app/payload-mapping.md) for choosing which fields reach Flow. ## Step 2 - Add the endpoint in Svix Add the URL as the endpoint in the sending service's webhook settings, then reveal and copy its signing secret (it starts with `whsec_`). ### How to find your Svix signing secret The endpoint signing secret starting with whsec_, from the webhook settings of the service. [Svix's own documentation on webhook signatures](https://docs.svix.com/receiving/verifying-payloads/how-manual) has the exact wording and screenshots for your account. Paste that secret into the webhook's **Secret** field in Workflow Webhooks and save. From that moment every Svix delivery is verified before it reaches Flow. ## What this checks | What | Value | | --- | --- | | **Signature header** | `svix-signature` | | **Where the signature sits** | The header value, after the prefix `v1,` | | **What is signed** | `{header:svix-id}.{timestamp}.{body}` | | **Signature** | HMAC-SHA256, base64 encoded | | **Timestamp** | The `svix-timestamp` header, as Unix seconds | | **Replay protection** | Requests whose signed timestamp is more than 5 minutes away from now are rejected | | **The secret** | Base64-decoded before use. The leading `whsec_` is stripped before decoding. Paste it exactly as the sender shows it | In the signed payload, `{body}` is the raw request body, byte for byte, and `{timestamp}` is the timestamp above, and `{header:svix-id}` is the `svix-id` request header. A request that fails any of these is rejected with `401`, is recorded in [History and troubleshooting](https://docs.workflow-webhooks.app/history-and-troubleshooting.md), and never starts a workflow. ## Step 3 - Build the Shopify Flow workflow 1. In **Shopify Flow**, create a workflow and choose the **Workflow Webhooks** trigger. 2. Press **Record events**, then send a test event from Svix (or use **Send test** in Workflow Webhooks) so Flow learns the shape of your data. 3. Every webhook you own fires the same Flow trigger, so add a first condition on the **webhook id** to keep this workflow to Svix only. The id is shown on the webhook page. 4. Add your actions - tag a customer, add a note, send an internal email, update a metafield. ## Step 4 - Test it end to end Trigger a real event in Svix. In **Workflow Webhooks -> History** you should see the invocation with status **Success**. If the signature was wrong you get a failed entry with the reason instead, and [Verifying signed webhooks](https://docs.workflow-webhooks.app/signature-verification.md) explains the signature tester that shows you exactly which step failed. ### The signature does not match In this order: the **secret** (the most common cause - an extra space, or a key from the wrong environment), whether the sender is using a **different endpoint's** secret, and whether anything between Svix and the app **rewrites the body**. Signatures cover the raw bytes, so a proxy that re-formats JSON breaks them. The signature tester on the webhook page shows the exact text that was signed. ### I get 401 on every request Check that the webhook's authentication is set to **HMAC** with the **Svix** provider selected, that the secret is filled in, and that Svix is posting to the URL exactly as the app shows it, including the code at the end. ### Nothing appears in History The request never arrived. Re-check the URL in Svix, and look at Svix's own delivery log for the response it got. A `404` means a wrong or deleted webhook, a `429` means you are over your plan's invocation limit - see [Plans and usage](https://docs.workflow-webhooks.app/plans-and-usage.md). ### The workflow runs for the wrong events Every webhook in your store fires the same Flow trigger. Add a condition on the **webhook id** as the first step of the workflow, or narrow the events you send from Svix. ### Requests fail with "timestamp outside tolerance" Svix signs a timestamp and the app rejects anything more than 5 minutes old. This is normally a clock problem on the sending side, or a delivery that Svix retried much later with the original timestamp. Retries from the same original request cannot pass; ask Svix to send a fresh event. ## Related - [Verifying signed webhooks](https://docs.workflow-webhooks.app/signature-verification.md) - every provider we verify, and how to describe one we do not. - [Payload mapping and Flow variables](https://docs.workflow-webhooks.app/payload-mapping.md) - getting the right fields out of the payload and into Flow. - [Duplicate delivery protection](https://docs.workflow-webhooks.app/duplicate-delivery.md) - what happens when Svix retries a delivery. - [History and troubleshooting](https://docs.workflow-webhooks.app/history-and-troubleshooting.md) - the log of every request, with replay.