openwebhook.coOpen inspector →
developer guide

Shopify orders/create Webhook Payload Example

Example JSON for the Shopify orders/create webhook, including X-Shopify-Topic, HMAC headers, and a cURL you can inspect live.

By David Lorenzo García··7 min read

Shopify’s orders/create (also written orders/created in older docs) POSTs the order resource when a store creates an order. This is the payload people look up for “shopify order created webhook”.

https://hooks.openwebhook.co/YOUR_UUID/shopify

In the Shopify admin: Settings → Notifications → Webhooks, or an app subscription to ORDERS_CREATE. Get a URL from the free inspector.

Headers

POST /shopify HTTP/1.1
Host: hooks.openwebhook.co
Content-Type: application/json
X-Shopify-Topic: orders/create
X-Shopify-Shop-Domain: acme-demo.myshopify.com
X-Shopify-Order-Id: 820982911946154508
X-Shopify-Webhook-Id: b54557e4-bdd9-4b37-8a5f-6d6a3340e077
X-Shopify-Triggered-At: 2026-09-08T08:22:11.000000Z
X-Shopify-Hmac-Sha256: 8K1p2n0vQe7yXz4mR9sL0tU2wA3bC5dE6fG7hI8jK9l=
X-Shopify-API-Version: 2024-10

X-Shopify-Hmac-Sha256 is Base64(HMAC-SHA256(raw body, app secret)). Compare with a constant-time check. Topic and shop domain must match the subscription you expected.

orders/create body (trimmed but valid shape)

{
  "id": 820982911946154508,
  "admin_graphql_api_id": "gid://shopify/Order/820982911946154508",
  "email": "jon@example.com",
  "created_at": "2026-09-08T10:22:11+02:00",
  "updated_at": "2026-09-08T10:22:11+02:00",
  "number": 234,
  "order_number": 1234,
  "token": "123456abcd",
  "gateway": "shopify_payments",
  "financial_status": "paid",
  "fulfillment_status": null,
  "currency": "EUR",
  "total_price": "199.00",
  "subtotal_price": "165.00",
  "total_tax": "34.00",
  "total_discounts": "0.00",
  "buyer_accepts_marketing": false,
  "note": null,
  "tags": "webhook-test",
  "customer": {
    "id": 115310627314723954,
    "email": "jon@example.com",
    "first_name": "Jon",
    "last_name": "Snow"
  },
  "shipping_address": {
    "first_name": "Jon",
    "last_name": "Snow",
    "address1": "Winterfell",
    "city": "The North",
    "country": "Spain",
    "zip": "28001"
  },
  "line_items": [
    {
      "id": 866550311766439020,
      "title": "Webhook handbook",
      "quantity": 1,
      "sku": "WH-01",
      "price": "165.00",
      "variant_id": 808950810,
      "product_id": 632910392
    }
  ]
}

Handlers usually key off id, financial_status, email, and line_items[].sku. GDPR apps must treat PII as customer data.

cURL

curl -X POST \
  'https://hooks.openwebhook.co/YOUR_UUID/shopify' \
  -H 'content-type: application/json' \
  -H 'x-shopify-topic: orders/create' \
  -H 'x-shopify-shop-domain: acme-demo.myshopify.com' \
  -H 'x-shopify-hmac-sha256: test' \
  --data-binary '{"id":820982911946154508,"email":"jon@example.com","financial_status":"paid","currency":"EUR","total_price":"199.00","line_items":[{"title":"Webhook handbook","quantity":1,"price":"165.00"}]}'

Shopify retries on non-2xx. To watch those retries, set a custom HTTP response of 500 on a Pro slug, then switch back to 200.

Related guides