Shopify webhooks / app webhooks not delivering — HMAC, endpoint HTTPS, GDPR topics, Delivery status.

Several products can look like “my automation never got the order / customer event.” They do not share a settings panel. This page is only when Shopify Admin webhooks or an app’s webhook subscriptions should POST to your HTTPS endpoint and never arrive — HMAC rejects, TLS / DNS fails, Delivery status failed, or GDPR mandatory topics were never registered. A Flow that never runs is Shopify Flow not triggering. Helpdesk macros / rules that stay quiet is Gorgias rules not firing. Meta Conversions API silence is Meta CAPI events missing. Automatic Functions discounts missing at checkout is Functions discount not applying. This page is only: Shopify / app webhooks not delivering.

Six ordinary reasons webhook deliveries stay blank: receiver rejects or ignores HMAC, endpoint is HTTP / localhost / expired ngrok, TLS cert or DNS broken, mandatory GDPR topics missing on the app, Delivery status shows failed with retries exhausted, or you are debugging Flow / Gorgias / CAPI / Functions instead. Walk them in that order. You already pay for Shopify. You do not need another seat to read Delivery status and fix an HTTPS URL.

Every Shopify webhook POST includes X-Shopify-Hmac-Sha256. Your receiver must compute HMAC-SHA256 over the raw body with the webhook signing secret (Admin notification webhooks use the shop’s webhook secret; apps use the app client secret / app webhook secret depending on the subscription path). If you verify against the wrong secret, re-encode the body as JSON before hashing, or strip headers before reading the body, Shopify will keep “sending” while your app returns 401/403 or silently drops the event.

Honest proof: log the computed HMAC vs the header on a single test delivery, confirm you hash the raw bytes (not a re-parsed object), and return 200 only after verification succeeds. If the failure is Flow conditions / triggers — not HTTP delivery — leave for Shopify Flow not triggering. Do not mix those proofs.

Shopify only delivers to a publicly reachable HTTPS URL with a valid certificate. HTTP, localhost, private VPC hosts, and expired ngrok / Cloudflare Tunnel URLs fail delivery even when your local logs looked fine yesterday. A subscription that still points at last week’s tunnel hostname is the most common “it worked in staging” trap.

Fix: Settings → Notifications (Admin webhooks) or the app’s Partners / webhook subscriptions → open the URL. Confirm https://, a live DNS A/AAAA or CNAME, and that curl from the public internet returns 200 on a health check (and accepts POST). Rotate the URL if the tunnel died. If Meta CAPI Test Events are empty instead of Shopify Delivery status, leave for Meta CAPI events missing.

Public apps that access customer data must subscribe to the mandatory GDPR / privacy topics (customers/data_request, customers/redact, shop/redact — names per current Shopify docs). Missing those topics can block app review, leave privacy webhooks undelivered, or leave merchants thinking “webhooks are broken” when only the privacy trio was never registered. Separate from that: an orders/create (or other commerce) topic that was never created, was deleted, or is scoped to the wrong shop will never fire.

Fix: Partners → App → Versions / Webhooks (or Admin webhook subscriptions for store-owned endpoints) → list every topic. Confirm GDPR mandatory topics exist for the app, and that the commerce topics you expect are present on the live shop with the current HTTPS address. Recreate the subscription if it points at a deleted endpoint. Gorgias rule silence after tickets already arrive is a different product — leave for Gorgias rules not firing.

Shopify surfaces Delivery status per webhook (Admin Notifications webhook history / app webhook delivery logs). Read it before rewriting business logic. Common rows: response timeout, non-2xx status, TLS handshake failure, DNS failure, connection refused. Shopify retries with backoff; after retries are exhausted the event is gone unless you rebuild from Admin API / event sources. A 200 that still “does nothing” is usually your receiver dropping after HMAC or writing to the wrong shop / environment — still this page’s product until Delivery status is green.

Fix: trigger one real event (test order, customer update) → open Delivery status → confirm success and latency. If status is success but your ops channel never updates, the bug moved downstream of the webhook (your worker / queue) — still start here so you stop blaming Flow / CAPI. Automatic discount lines missing at checkout are not webhook Delivery status — leave for Functions discount not applying.

A Flow that never enters its condition tree is Shopify Flow not triggering. Gorgias macros / rules that never fire on tickets is Gorgias rules not firing. Meta Conversions API / pixel Test Events empty is Meta CAPI events missing. Functions / Checkout UI / automatic discount never applying is Functions discount not applying.

The only honest test for this page: a subscribed Shopify or app webhook never POSTs successfully to your HTTPS endpoint — prove HMAC + secret, prove public HTTPS, prove GDPR + commerce topics exist, read Delivery status to success, hard-refresh / re-subscribe. Anything else is a different product.

Stay DIY if you can spend one afternoon on the list above: fix HMAC verification, replace HTTP / dead tunnels with public HTTPS, register GDPR + commerce topics, read Delivery status to success, and stop confusing Flow / Gorgias / Meta CAPI / Functions discounts with a failed webhook POST. That is the whole playbook. No agency required. Short answers also live on the merchant FAQ. Related pages: Flow not triggering, Gorgias rules not firing, Meta CAPI events missing, Functions discount not applying.

Pay for help when the work is not the webhook URL toggle — it is connecting the stack you already have so lead capture is not dying in DMs, storefront and checkout-ready exceptions land in a channel you already check, and the live store is one workflow instead of a spreadsheet plus a Slack bot you forgot. That is the Latch AI Ops install.

What $997 USD one-time buys: lead capture on the live store, ops alerts in a channel you already check, and a checkout-ready workflow. 72 hours after collaborator access, not after payment. One live Shopify store. Access plus a delivery thread. Store URL collected at checkout. Not a SaaS seat, not a theme rebuild retainer, not a conversion guarantee, not a brand or theme job.

Other shops’ public ranges, not testimonials: a checkout / ops install typically runs $500–$2,500. A full ops consulting block typically runs $2,000–$5,000. $997 is the cheap end of that work, sold as a 72-hour install of three systems — not as an earnings number or conversion-lift claim.

What it does not buy: more orders, recovered revenue, a forever webhook-proof ops guarantee, or a case study. Latch AI Ops has not published customer proof because there are no customers yet. You are buying the install.

Checkout is on Whop. Operator is Nico. United States offer. You can revoke collaborator access after handoff. We do not take owner passwords.