This article explains "Mandatory Webhooks," one of the points that can trip you up when you start developing a Shopify app.
I'm sure many of you have experienced an app review not passing because these webhooks were not implemented, or because the implementation was insufficient.
Please check this so you do not get stuck during review!
What are webhooks?
Before explaining Shopify's Mandatory Webhooks, let's understand what webhooks are.
Webhooks are an event notification mechanism used to integrate with web applications.
By using webhooks, you can receive data or perform some action when a specific event occurs in a web application.
As an example familiar to engineers, webhooks are used to automatically run builds and tests when code is pushed to GitHub.
Shopify Webhooks
These webhooks can also be used with Shopify.
In Shopify app development, you can use webhooks from the Shopify Admin API.
You can also create webhooks from the Shopify admin outside of an app.
In addition to HTTPS endpoints, Shopify webhooks can also use messaging services such as Amazon EventBridge and Google Cloud Pub/Sub.
Depending on the events you subscribe to and the merchants using your app, you may need to process a large number of webhooks in a short period of time, so we recommend processing webhooks with a messaging service that can scale easily.
What are Mandatory Webhooks?
Mandatory Webhooks are the three webhooks that must be implemented when developing a Shopify app.
These three webhooks are required for GDPR compliance, and all Shopify apps must comply with GDPR regardless of whether they are in EU member countries.
If Mandatory Webhooks are not implemented, your app will be rejected during app review. (Webhooks other than the three Mandatory Webhooks can be implemented as needed.)
Also, the three Mandatory Webhooks can only be created with HTTPS endpoints. The EventBridge and Pub/Sub mentioned above cannot be used.
What is GDPR?
GDPR (General Data Protection Regulation) is a European Union (EU) personal data protection regulation that came into effect on May 25, 2018.
It is designed to protect the privacy of personal information across the EU and give individuals more control over how their data is handled.GDPR applies to all organizations that process the personal data of EU citizens or residents. This includes organizations both inside and outside the EU, and requires them to comply with GDPR when processing data from EU citizens or residents, no matter where in the world the organization is located.
The main purpose of GDPR is to strengthen and unify the idea that individuals should have the right to know and control how their personal data is collected, stored, and used. It grants individuals several important rights, including transparency around personal information, the right of access, the right to rectification, the right to be forgotten (the right to data erasure), and the right to data portability.
Reference: ChatGPT
Examples of how to handle Mandatory Webhooks
As explained above, Mandatory Webhooks are webhooks for complying with GDPR, so how you respond differs depending on whether you store customer information or store information in a database or similar system.
If you do not store the data in a database
If you do not store customer information or store information in a database, there is nothing special you need to do. It is enough to return a success response indicating that the webhook was properly received.
Please refer to the templates for each language for implementation methods.
If you store the data in a database
If you store customer information or store information in a database, you need to be able to delete the data for the webhook target or provide the requested data to the merchant.
Because handling data deletion requests manually each time is difficult, we recommend automating data deletion when a webhook is received.
Summary
We explained Shopify webhooks, especially Mandatory Webhooks.
To avoid various risks, I think choosing not to store customer information as a basic policy is a good option.
If you need to store customer information, be especially careful to support Mandatory Webhooks.
