The happy path is easy. Production is not.

Shopify emits a lot of webhooks. Meta expects a clean, authenticated Graph API call with a valid template and recipient.

The gap between those two worlds is where teams lose weekends:

duplicate events,
partial payloads,
retries that re-send the same template,
or tokens living in places they should not.

Idempotency is not optional

If your flow sends “dispatched” on fulfillments/create, you should assume Shopify will retry delivery and you will see duplicates.

Use a durable idempotency key per (orderId, eventType, templateName, recipient) — not “timestamp now”. Store it for at least 7 days. If the key exists, exit early.

This single habit prevents the worst customer experience in WhatsApp automation: three identical messages for one shipment scan.

Never let a webhook handler hold your secrets

Your Cloud API token should live server-side only.

The common anti-pattern is “quick script” logic embedded in theme code or a public endpoint that accepts arbitrary payloads. That is how you get abuse, billing surprises, and Meta restrictions.

Prefer:

a server route or worker that validates Shopify signatures (when applicable),
strict allowlists on which topics you accept,
and rate limits per shop and per customer.

Map events to human outcomes, not developer events

orders/updated is noisy. Customers do not care that a row changed — they care that their parcel moved.

We usually anchor operational messaging on narrower signals where possible:

fulfilment creation / tracking number availability,
refund completion,
or payment capture outcomes.

If you cannot explain the customer benefit in one sentence, you probably should not send a template for that webhook.

Observability is part of the product

If you cannot answer “why did this customer get message X at time Y?” from logs, you do not have automation — you have a lottery.

At minimum, store:

Shopify resource IDs,
webhook topic,
template name + language,
send response status,
and correlation IDs for retries.

When you want this done without drama

This is the kind of plumbing we implement alongside Shopify Admin apps and ops dashboards — not as a gimmick, but as reliable revenue and support infrastructure.

Start here if you are scoping: API integrations and WhatsApp automation.

From Shopify webhooks to Meta Cloud API messages: guardrails that keep you out of trouble