Setup Mandatory Webhooks on Shopify APP - Step by Step Guide
Here is the step by step with images tutorial to implement Mandatory Webhooks on Shopify public app. I proceed with example of php.
Note: English is not my first language, so there may be some grammatical mistakes. I'm open to implement your suggestion, if you find any mistakes:)
In response to the General Data Protection Regulation (GDPR), Shopify introduced some important changes to our platform to help you properly handle the privacy and security of customers’ personal information.
Three mandatory webhooks need to be added to every public app:
-
customers/redact
- Requests deletion of customer data. -
shop/redact
- Requests deletion of shop data. -
customers/data_request
- Requests to view stored customer data.
First of all, you need to setup endpoints on your server where you can handle these requests. I filled up endpoints in below image for informative purpose.
customers/data_request
When a customer requests their data from a store owner, Shopify sends a payload on the customers/data_request
topic to the apps installed on that store. If your app has been granted access to customers or orders, then you receive a data request webhook with the resource IDs of the data that you need to provide to the store owner.
For ex. when customer asked for viewing their data to shop owner, then shop owner will open that customers dashboard and hit on "Send Customer Data" button[refer Image - 2 (a)].
Now Shopify will send request to that topic endpoint[refer Image - 1 (a)].
For our APP we will receive request on
https://app-path.com/cust_data_request.php
you will have to handle that request, for reference check below code
Same process you will have to follow for rest of two webhooks, difference is you will have to erase related data from your server if you're storing.
customers/redact
When a customer requests deletion of their data from a store owner, Shopify sends a payload on the customers/redact
topic to the apps installed on that store. If your app has been granted access to the store's customers or orders, then you receive a redaction request webhook with the resource IDs that you need to redact or delete. In some cases, a customer record contains only the customer's email address.
For our APP we will receive request on
https://app-path.com/cust_data_erasure.php
shop/redact
48 hours after a store owner uninstalls your app, Shopify sends you a shop/redact
webhook. This webhook provides the store's shop_id
and shop_domain
so that you can erase the customer information for that store from your database.
For our APP we will receive request on
https://app-path.com/shop_data_erasure.php
References: Shopify guides and community discussion.