Shopify CRM

Overview

The Shopify integration brings your store's orders, customers and abandoned carts into WaDesk, so you can recover carts, confirm orders, and support buyers over WhatsApp — with the order context right there in the chat and your pipeline. Pair it with the WhatsApp Catalog, Auto-Invoicing and Payment Links to sell, invoice and collect inside the conversation.

Where: Integrations → Shopify. It sits alongside WooCommerce and the general E-commerce & CRM integrations.

How the Integration Works

• WaDesk talks to your store through Shopify's Admin API, authenticated with an access token tied to a set of scopes (read permissions) you grant.
• On connect, WaDesk runs an initial sync of recent customers and orders so they're immediately usable as contacts and deals.
• Going forward, Shopify webhooks notify WaDesk of new orders, order updates, new customers and abandoned checkouts, keeping data fresh without polling.
• Everything is scoped to your workspace; each synced customer becomes a WaDesk contact you can message and segment.

Credentials: Admin Sets the App, Merchants Just Connect

Shopify in WaDesk uses OAuth, not a pasted token. The platform admin registers one Shopify app and stores its credentials once; each merchant then connects by entering only their store domain and approving Shopify's consent screen. There is no Admin API token to copy or paste anywhere in WaDesk.

Platform admin — one time

1. Create a Shopify app. In the Shopify Partner Dashboard (partners.shopify.com), create an app to get a Client ID (API key) and Client Secret (API secret key).
2. Set the redirect (callback) URL to WaDesk's Shopify OAuth callback (shown in WaDesk admin).
3. Request the scopes your integration needs — at least read_orders, read_customers, read_checkouts (abandoned carts) and read_products.
4. Add the mandatory GDPR compliance webhooks — via the Shopify CLI. See the step-by-step below. Shopify requires these before App Store approval, and the new Dev Dashboard has no UI field for them — they must be declared in the app's shopify.app.toml and pushed once with the CLI.
5. Enter the credentials in WaDesk admin. Fill shopify_client_id, shopify_client_secret, shopify_scopes and shopify_redirect_uri, then enable Shopify (shopify_enabled). Every workspace reuses these — merchants never see them.

Mandatory GDPR webhooks — Shopify CLI (one time)

Shopify requires three GDPR compliance webhooks, or the install silently fails and the app-review checks stay red. The new Dev Dashboard has no UI field for them — they are declared in the app's shopify.app.toml and pushed once with the Shopify CLI. This is a one-time setup, with no ongoing CLI use.

1. Install the CLI:

   npm i -g @shopify/cli@latest

2. Link your app — pick this app when prompted; it writes shopify.app.toml:

   shopify app config link

3. Add this block to that file, replacing the URL with your own (copy it from WaDesk Admin → Settings → Shopify, step 5):

   [webhooks]
   api_version = "2026-07"
   
     [[webhooks.subscriptions]]
     compliance_topics = [ "customers/data_request", "customers/redact", "shop/redact" ]
     uri = "https://YOUR-DOMAIN/shopify/compliance"

4. Push it:

   shopify app deploy

All three topics point at that one fixed URL. Unlike the per-store order webhook, it carries no secret in the path — deliberately, so Shopify's automated review can reach it before any store has installed the app.

Every delivery is verified. Shopify signs each request with HMAC-SHA256 using your Client Secret. WaDesk checks the X-Shopify-Hmac-Sha256 header and returns 401 on a mismatch, 200 on success — then honours the request (erasing the customer's or shop's stored data). This is what satisfies Shopify's “Verifies webhooks with HMAC signatures” check.

Skip this and the app cannot be approved. The automated checks fail on “Provides mandatory compliance webhooks” and “Verifies webhooks with HMAC signatures”, and installs fail silently with no visible error.

Merchant — per store

1. Open Integrations → Shopify in WaDesk.
2. Enter your store domain (your-store.myshopify.com) — that's the only field.
3. Click Connect — you're sent to Shopify's consent screen; approve the requested scopes.
4. Done. Shopify redirects back, WaDesk verifies the HMAC + state and exchanges the code for a permanent access token automatically, storing it against your integration. No token handling on your part.

Protected customer data. Orders, customers and abandoned checkouts include personal data. Shopify requires the app that accesses it to have protected customer data access approved — abandoned-checkout data in particular is gated behind this. This is configured on the Shopify app once, by the admin, not per merchant.

API Limits & Rules

Connecting Your Store

1. Open Integrations → Shopify and enter your store domain to start the connection.
2. Approve the OAuth consent on Shopify — no token to paste; WaDesk receives the access token automatically on redirect back.
3. WaDesk subscribes to store webhooks — orders create/update, customers create, and checkouts (abandoned).
4. Initial sync pulls recent customers and orders so they're usable at once.

Embedded-app session note. If you open WaDesk embedded inside Shopify admin (in an iframe), browsers require the session cookie to be SameSite=None; Secure so it isn't dropped in the cross-site frame — otherwise you'd hit a 419 / login loop. WaDesk sets this for the embedded context so actions work without re-logging-in.

What Syncs

Using It

• Order confirmations & updates. Send order/shipping updates over WhatsApp using approved templates.
• Cart recovery. Reach customers who left items behind — manually, with a flow, or as a broadcast to an eligible segment.
• Support in context. When a customer messages, their recent orders show in the thread so agents answer without switching tabs.
• Pipeline & revenue. Turn high-value orders or repeat buyers into deals, and let the AI CRM Copilot report on them.

Troubleshooting