Webhooks
All webhooks verify the Shopify HMAC (verifyShopifyWebhookHmac) before processing and are
registered in shopify-app/shopify.app.toml.
Registered topics
| Topic | Route | Purpose |
|---|---|---|
app/uninstalled | /api/webhooks/app/uninstalled | Clean up store on uninstall |
products/create,update,delete | /api/webhooks/products | Keep catalog_products in sync |
app_subscriptions/update | /api/webhooks/app/subscriptions/update | Billing sync — maps status, resets usage on activation, clears custom on a standard plan, cancels any other active sub (single-active layer 2), and records a billing_events row (see Billing Pipeline) |
customers/data_request | /api/webhooks/customers/data_request | GDPR — data request |
customers/redact | /api/webhooks/customers/redact | GDPR — delete shopper data (deleteShopperData) |
shop/redact | /api/webhooks/shop/redact | GDPR — delete shop data |
GDPR compliance
The three compliance_topics webhooks are mandatory for App Store approval. customers/redact
permanently deletes the shopper’s captured emails / try-on data by email + Shopify customer
id. All three verify HMAC and return 200 quickly.
App proxy
/api/proxy is the Shopify app proxy entrypoint (apps/tryvio subpath), used by the
storefront widget for same-origin signed requests.
Adding a webhook
- Add the subscription to
shopify-app/shopify.app.toml. - Implement the route under
app/api/webhooks/…with HMAC verification. cd shopify-app && npx shopify app deploy --allow-updates.