Inbound Webhooks
Last updated 2026-10-13
External systems push events (e.g. Shopify orders) into Docklify — no login required, HMAC-verified.
Entry point#
External systems POST to POST /api/integration/webhooks/[code], where code is the connector code (P0: shopify). No login is required. The platform finds the tenant’s enabled + published flow whose trigger is webhook for that connector, then executes it.
POST /api/integration/webhooks/shopify
x-shopify-topic: orders/create
x-shopify-shop-domain: my-store.myshopify.com
x-shopify-hmac-sha256: <hmac-signature>
Content-Type: application/json
{ "id": 123456789, "order_number": 1001, "line_items": [ … ], … }HMAC verification & tenant routing#
- When the flow’s trigger_config sets webhook_secret, the x-shopify-hmac-sha256 signature is verified — reject unsigned requests.
- Tenant routing: x-shopify-shop-domain is matched against the connection config store_domain; if no match but the candidate is unique, it is used; otherwise 404.
P0 currently supports shopify orders/create. More connectors and topics land as their integration flows are published — configure webhook_secret for every production flow.