Playbook · Webhooks not delivering / failing

Shopify webhooks not delivering — or app webhook deliveries keep failing.

Written for a Shopify owner or app builder whose Admin or app webhooks never reach the HTTPS endpoint, return HMAC failures, sit in a Delivery status retry backlog, or drop after retries are exhausted — usually wrong shared secret / raw-body HMAC, HTTP or localhost / dead tunnel URL, missing mandatory GDPR topics, slow or non-2xx responses, or you diagnosed Meta CAPI / Klaviyo / 3PL write-back instead. DIY-first: prove topic subscription → HMAC → HTTPS reachability → GDPR topics → Delivery status backlog. Distinct from Meta CAPI events missing, Klaviyo flow not sending, and 3PL tracking not writing back. No earnings claims, no invented case studies.

Nico at Latch AI Ops · Sep 9, 2026 · ~12 minute read

Buy the 72-hour install — $997Meta CAPIKlaviyo flowMerchant FAQ

01

Webhooks not delivering — not Meta CAPI, Klaviyo flows, 3PL write-back.

Several products can look like “events never arrived.” They do not share a settings panel. This page is only when Shopify or app webhook POSTs fail, retry, or never hit your HTTPS receiver. Meta / Facebook Conversions API purchase (or other) events missing in Events Manager is meta-capi-events-missing. Klaviyo flow not sending / stuck / quiet is klaviyo-flow-not-sending. Carrier / 3PL tracking never writing back onto the Shopify order is 3pl-tracking-not-writing-back.

Also not this page: Shopify Flow not triggering, Gorgias rules not firing, Functions / automatic discount not applying, or a pixel browser event you expected in Meta Pixel Helper. Those are different templates and products. Use this playbook when Admin → Notifications / app webhook Delivery status shows failed / pending / retries exhausted — not when CAPI, Klaviyo, or 3PL tracking is the actual silent channel.

02

HMAC verification + public HTTPS endpoint (not localhost / dead tunnel).

Shopify signs every webhook with X-Shopify-Hmac-Sha256. Your receiver must verify that header against the raw request body and the correct shared secret (app secret or Admin webhook signing secret) — not a re-encoded JSON string, not a different app’s secret, not a truncated body after a middleware rewrite. A wrong HMAC usually surfaces as 401/403 from your app or as Delivery status failures while the topic looks “subscribed.”

Confirm the subscribed URL is the live public HTTPS endpoint you actually run in production. HTTP, localhost, a stale ngrok / Cloudflare tunnel, a typo’d path, or a staging host that now 404s will never deliver. Rotate dead tunnels; paste the current URL into Admin webhook settings or the Partner app webhook subscriptions and save.

The endpoint must answer quickly with a 2xx after HMAC passes. Long-running work belongs on a queue after you ack. Timeouts, 5xx storms, and TLS / certificate errors fill the retry backlog even when the topic subscription is correct. Test with Shopify’s “Send test notification” (or your app’s equivalent) and read the response code before blaming Flow or CAPI.

03

Mandatory GDPR topics + Delivery status / retry backlog.

Public apps must subscribe to the mandatory GDPR / customer data request topics (customers/data_request, customers/redact, shop/redact — names as Shopify documents them for your API version). Missing those topics can block app approval and leave compliance webhooks undelivered while order webhooks look fine. Private Admin webhooks still need the topics you actually depend on — orders/create without orders/updated is a common “half live” config.

Open Delivery status (Admin Notifications webhook deliveries, or your Partner dashboard / app logs). Read failed vs pending vs success. A growing retry backlog means Shopify is still attempting delivery after non-2xx / timeouts — fix the receiver first, then wait for retries to drain or re-subscribe after the endpoint is healthy. “Retries exhausted” means those events are gone unless you backfill from Admin / API — do not expect Meta CAPI or Klaviyo to replay them.

After fixing HMAC / HTTPS / topics, send a controlled test order (or Admin test notification) and confirm a green delivery before declaring the integration healthy. If only one topic fails while others succeed, fix that topic’s handler — not the whole store’s pixel or email stack.

04

You tested Meta CAPI, Klaviyo, or 3PL tracking write-back instead.

Meta Conversions API events missing in Events Manager is meta-capi-events-missing. Klaviyo flow not sending is klaviyo-flow-not-sending. 3PL / carrier tracking not writing back to the Shopify order is 3pl-tracking-not-writing-back.

The only honest test for this page: subscribed topic, correct HMAC secret + raw body, public HTTPS endpoint returning 2xx, mandatory GDPR topics present for apps, Delivery status showing success (and the retry backlog draining) after a test notification. Anything else is a different product.

05

When to stay DIY vs pay $997.

Stay DIY if you can spend one afternoon on the list above: fix HMAC against the raw body and correct secret, point the subscription at a live public HTTPS endpoint, add mandatory GDPR topics for apps, clear the Delivery status retry backlog with healthy 2xx responses, and stop confusing Meta CAPI / Klaviyo / 3PL write-back with webhook delivery failure. That is the whole playbook. No agency required. Short answers also live on the merchant FAQ. Related pages: Meta CAPI, Klaviyo flow, 3PL tracking write-back, Shopify Flow not triggering.

Pay for help when the work is not the webhook toggle — it is connecting the stack you already have so lead capture is not dying in DMs, storefront and checkout-ready exceptions land in a channel you already check, and the live store is one workflow instead of a spreadsheet plus a Slack bot you forgot. That is the Latch AI Ops install.

What $997 USD one-time buys: lead capture on the live store, ops alerts in a channel you already check, and a checkout-ready workflow. 72 hours after collaborator access, not after payment. One live Shopify store. Access plus a delivery thread. Store URL collected at checkout. Not a SaaS seat, not a theme rebuild retainer, not a conversion guarantee, not a brand or theme job.

Other shops’ public ranges, not testimonials: a checkout / ops install typically runs $500–$2,500. A full ops consulting block typically runs $2,000–$5,000. $997 is the cheap end of that work, sold as a 72-hour install of three systems — not as an earnings number or conversion-lift claim.

What it does not buy: more orders, recovered revenue, a forever webhook-uptime guarantee, or a case study. Latch AI Ops has not published customer proof because there are no customers yet. You are buying the install.

Checkout is on Whop. Operator is Nico. United States offer. You can revoke collaborator access after handoff. We do not take owner passwords.