Shopify mandatory webhooks metafield blank? Prove registration, HMAC, and the owner field.

Use this page when the mandatory webhook endpoint is reachable and authenticated, but the metafield your compliance job needs is empty or absent for the customer or shop named in the payload. If Partner Dashboard never lists successful deliveries for the three mandatory topics, fix registration and endpoint reachability first—not the metafield definition.

Capture topic name, shop domain, delivery ID, HTTP status your endpoint returned, HMAC pass/fail, customer or shop id from the body, namespace.key, and whether Admin still shows a saved value on that owner. Do not invent a second definition before proving the owner the payload names.

Confirm all three mandatory topics are registered for the live app: data request, customer redact, and shop redact. The HTTPS URL in Partner Dashboard must match the handler that is deployed today—not a staging tunnel or an old Cloudflare worker. A toml-only local registration that never reached production Partner config is a different failure from a blank metafield.

Use one synthetic, reversible shop or customer fixture when Partner tooling allows a test delivery. Record topic, endpoint, shop, delivery timestamp, and app log correlation id. Minimize personal data—log IDs and field presence, not full PII dumps.

Verify X-Shopify-Hmac-Sha256 against the raw request body and the app’s shared secret before any metafield query. A 401 from HMAC failure can look like “compliance never ran,” while a 200 that skipped verification can process a forged body and miss the real owner. Confirm X-Shopify-Shop-Domain matches the install you expect.

Keep this distinct from webhook HMAC metafield blank for ordinary order/product topics. Mandatory topics still need the same HMAC discipline, but Partner review and compliance SLA differ.

Parse the mandatory payload for customer id, orders_to_redact, or shop id as documented for that topic. Query the metafield on that exact owner with the same namespace.key and API version your job uses. A saved Admin value on a different customer, a draft definition, or an app-owned field the compliance token cannot read will look blank even when HMAC passed.

Separate absent key, null, empty string, and empty list. If Admin shows the test value and the job still sees blank, fix token scopes, API version, or owner id mapping—not a new metafield namespace. Do not paste secrets or full customer payloads into tickets. For deeper GDPR payload notes see GDPR webhooks metafield blank.

Replay or trigger one controlled mandatory delivery on one known shop. Record topic, endpoint, HMAC result, shop domain, owner id, namespace.key, Admin value, handler field state, and HTTP status returned to Shopify. Retry only after the first trace is captured.

Classify the miss as topic/registration, endpoint/HMAC, owner mapping, definition/value, access/scopes, or handler field path. Keep it distinct from generic webhook subscription blanks and from app-proxy auth misses.

Stay DIY when one registration, HMAC, owner, or definition check explains the blank. Keep the proof packet so later compliance edits stay reversible and auditable.

Pay for the $997 one-time install when several Shopify surfaces, apps, and ops alerts need to be wired and documented on one live store. Nico at Latch AI Ops can connect the agreed workflow in a 72-hour window after collaborator access. No earnings claim, conversion guarantee, or theme rebuild is included; owner passwords are not requested.