The Admin API and webhooks in practice
Integrations against Shopify are mostly two mechanisms: the Admin API, which you call to read and write, and webhooks, which call you when something happens.
Both are straightforward. What separates a reliable integration from a flaky one is how you handle the cases where they misbehave — and they will.
The two mechanisms#
| Admin API | Webhooks | |
|---|---|---|
| Direction | You call Shopify | Shopify calls you |
| Good for | Reading state, writing changes, backfills | Reacting to events promptly |
| Failure mode | Rate limits, version changes | Duplicates, out-of-order delivery, missed events |
| Must handle | Retries and pagination | Idempotency and verification |
Rules that make integrations reliable#
- Verify every webhook signature before trusting the payload. Unverified endpoints are an open door.
- Make every handler idempotent — the same event will arrive twice eventually.
- Do not assume order. A cancellation can arrive before the creation you were waiting for.
- Return quickly and process asynchronously; slow endpoints get retried and then disabled.
- Reconcile daily against the API. Webhooks miss events; a nightly sweep catches what slipped.
Rate limits are a design input#
Shopify meters API access. That is not an obstacle to work around with retries; it is a constraint to design for. Batch reads, request only the fields you need, and use bulk operations for backfills instead of walking every product one call at a time.
If your integration only works when nothing else is running, it does not work. Test it while an import is in progress.
Versioning#
API versions are dated and expire. Put the upgrade in the calendar rather than discovering it through a failure. A small integration takes an hour to move forward; one that has skipped four versions takes a week.
Frequently asked questions
Webhooks or polling?
Webhooks for promptness, a periodic reconciliation for correctness. Most reliable integrations use both.
How do I stop duplicate processing?
Store the event identifier and ignore repeats. Idempotency is the single most valuable habit here.
What breaks first at scale?
Rate limits, usually during a backfill that walks records one at a time instead of using bulk operations.
shopify admin apishopify webhooksshopify integrationshopify api rate limitsshopify graphql api
