Shopify

Ideal for abandoned cart recovery and order tracking solutions.

Note

Shopify on Qefro is a metadata Marketplace App executed by generic Runtime HTTP. There is no Shopify SDK, connector process, or /qefro webhook in the app package. SDK connections remain for Focus ERP / Yaaz.

Installation

1. Install the Shopify Marketplace app on the target AI Workspace.
2. In the workspace Tools tab, Connect Shopify: shop domain plus that tenant’s Shopify app client ID and secret.
3. Chat tools use the workspace HTTP connection (shop host + encrypted Admin API token).
4. Webhooks POST to Qefro /webhooks/http/shopify. HMAC is verified with that workspace’s app secret on the raw body; topics map to Business Events via package metadata, then orchestration_events → CRM Automation.

Operator steps: Connect Shopify. Package internals: shopify-runtime.

Authentication

OAuth authorization code. Client id/secret are entered per workspace at Connect and encrypted at rest. Shop domain is validated (*.myshopify.com); OAuth state is workspace- and session-bound. Workspace A cannot steal workspace B’s shop.

Do not put Shopify app secrets in package YAML or process environment.

Events

Event name	Source topic (metadata)
order.created	orders/create
order.updated	orders/updated
order.cancelled	orders/cancelled
customer.created	customers/create
customer.updated	customers/update

Envelope fields (idempotency, correlation, TTL): Event reference.

Tools

Lookup products, customers, and orders through generic HTTP tools (read_products, read_customers, read_orders). Staff Console can list the shop. Customers on WhatsApp/widget see only their own orders (Hub email, OTP if needed, ownership after the response). Missing scopes reject execution. Keep PII minimization and least privilege.

Details: HTTP tools.

Webhooks

1. Receive provider webhook at the generic Qefro endpoint.
2. Identify the workspace from the shop identity header (selects that tenant’s app secret).
3. Verify HMAC on the raw body with that secret (constant-time). Reject missing/invalid signatures.
4. Map topic → Business Event via metadata; emit onto orchestration_events.
5. CRM Automation consumes the bus. Replay uses the Shopify webhook id.

Workflow checklist

Shopify go-live

1. Auth — Connect Shopify OAuth with per-workspace app credentials; tokens encrypted at rest.
2. Webhooks — Generic HMAC ingest; map to `order.*` / `customer.*`.
3. Flows / CRM — Chat tools + automations on Business Events.
4. Test emit — Idempotent webhook; watch Flow Runs / CRM.
5. Observe — Connection status + event list + dead-letter retry.

Related topics