Webhooks
Webhooks are how the Shopify connection stays in step with your store without waiting for the nightly sync. Shopify sends Oblifee a small set of events - when the app is uninstalled, when a subscription changes, and the mandatory data-privacy events - and Oblifee acts on each immediately. This page explains what each one does.
Every webhook is HMAC-verified against the raw request body before it is trusted, so Oblifee only acts on events that genuinely came from Shopify. Oblifee stores no customer personal data from Shopify in the first place, which is why two of the privacy events below are acknowledged rather than needing a deletion.
Events Oblifee receives
| Event | When Shopify sends it | What Oblifee does |
|---|---|---|
| app/uninstalled | You uninstall the Oblifee app. | Discards the store's stored access tokens, marks the store uninstalled (stopping the sync), and cancels the Shopify-billed subscription. |
| app_subscriptions/update | Your Shopify-billed subscription changes state. | Mirrors the new status onto your plan - active, past-due or cancelled - keeping Shopify as the source of truth for billing. |
| customers/data_request | A shopper asks the merchant for their data. | Records that the request arrived, with its timestamp. Oblifee holds no shopper personal data, so there is nothing to return - the audit record is the evidence of that. |
| customers/redact | Shopify requires a shopper's data be erased. | Records the request. There is no shopper personal data to erase, so this is a logged acknowledgement. |
| shop/redact | 48 hours after uninstall, Shopify requires the shop's data be erased. | Deletes the store's record from Oblifee entirely, in the same transaction as the audit entry. |
Why the privacy events are logged even when they are no-ops
Shopify's three compliance webhooks - customers/data_request, customers/redact and shop/redact -
are mandatory for every app. For Oblifee, the first two have nothing to act on, because the connector
only ever reads products and aggregate shipped quantities, never shopper names, emails or addresses.
But "we did nothing because we hold nothing" is only a defensible answer if you can show the request
arrived and when. So each event writes an audit record at the moment it is received. The audit log
is the evidence. shop/redact goes further and deletes the store record itself, writing its audit
entry in the same transaction so the record can neither outlive nor predate the deletion it describes.
Outbound webhooks
Oblifee does not currently push outbound webhooks to your own systems. To move data the other way - to send products, packaging or volumes into Oblifee from an ERP - use the REST API, which your system calls on its own schedule.
Where to go next
- Shopify - install, link and the sync these events support.
- REST API - push data into Oblifee from your own systems.
- Security & trust - how events are verified and data is isolated.