DELINK

Built for Shopify app developers

GDPR and CCPA requests hit your app as compliance webhooks. We handle them.

Route Shopify's three mandatory topics to Delink — HMAC verified on arrival, every 30-day fulfillment window tracked, every event in an exportable log. Or forward through to your existing handler — same signed POST, same headers.

7-day free trial. No card required. From $8.99/mo after.

Already have a handler? Forward the same signed Shopify POST to your URL — same body, same headers, included on every plan. How Forward works

Start free trialHow it works
  • HMAC verified on the raw body
  • Raw webhook body never stored
  • Live in minutes — one URL per app, no SDK
Product demo

Your event log

See what lands in your event log

A compliance webhook that reaches Delink and is successfully verified and persisted becomes a row you can track and export. Fulfillment — exporting or deleting customer data — still happens in your app.

Event log

my-app · sample data
Data requestacme-brand.myshopify.comReceived

Feb 12, 2026, 2:32 PM · Due Mar 14, 2026, 2:32 PM · Customer 8049479638721

Customer ID
8049479638721
Shop
acme-brand.myshopify.com
Received
Feb 12, 2026, 2:32 PM
Workflow due
Mar 14, 2026, 2:32 PM
Orders to redact
—
Shop ID
6123456789
Topic
Data requestcustomers/data_request
Status
Received
Event ID
evt_sample_data_request
Customer redactacme-brand.myshopify.comCompleted

Jan 8, 2026, 9:15 AM · Completed · Customer 8049479638721

Customer ID
8049479638721
Shop
acme-brand.myshopify.com
Received
Jan 8, 2026, 9:15 AM
Workflow due
Feb 7, 2026, 9:15 AM
Orders to redact
450789469, 450789470
Shop ID
6123456789
Topic
Customer redactcustomers/redact
Status
Completed
Event ID
evt_sample_customer_redact

Webhook body

Verified and parsed for limited metadata in memory — not intentionally written to disk

{
  "shop_domain": "acme-brand.myshopify.com",
  "customer": {
    "id": 8049479638721,"email": "jane@example.com","phone": "+1 555 0100"
  },
  "orders_requested": [450789469]
}
  • →customer.id maps to Customer ID in your log
  • —Email, phone, and raw JSON are not saved

Webhook bodies include customer emails and order details — verified and parsed for limited metadata in memory, not intentionally written to our database. This minimizes additional stored copies but cannot eliminate security risk.

How it works · Shopify mandatory compliance webhooks

Set up in minutes, not weekends

Register your app, paste the TOML snippet, and point Shopify at Delink — no webhook server to build or host.

  1. 1

    Register your app

    Webhook URL and signing secret in ~5 minutes.

  2. 2

    Point Shopify at Delink

    Copy the TOML snippet and run shopify app deploy.

  3. 3

    Ship and prove receipt

    HMAC ingest, workflow clock, event log, and exportable compliance event record when you need it.

    Optional

    Keep your handler

    Already built one? Turn on Forward — Delink relays the signed POST after verification, on every plan.

Pricing

Simple plans for Shopify app developers

HMAC ingest, event log, and workflow tracking — hosted so you do not have to build it.

7-day free trial — no card required. $8.99/mo (Solo) · $19.99/mo (Multi) after trial.

Compliance events remain visible through 90 days after the workflow due date on all plans.

Solo

Shopify compliance webhook toolkit for one app

$8.99/mo

Try the full console free for 7 days — subscribe anytime to keep access.

1 app · Event history through 90 days after the workflow due date

Track recorded compliance requests against a 30-day Shopify workflow target

7-day free trial. No card required.

  • HMAC-verified webhook ingest
  • Live event log + 30-day Shopify workflow clock
  • TOML snippet + webhook test tool
  • Update client secret after Shopify rotation
  • Complete / reopen workflow
  • Exportable compliance event record (CSV)
  • Forward — optional relay to your HTTPS endpoint
  • Uninstall monitor — count + history per app
  • Daily workflow digest email
Start free trial

Multi

Same features, three apps on one dashboard

$19.99/mo

Try the full console free for 7 days — subscribe anytime to keep access.

3 apps · Event history through 90 days after the workflow due date

Track recorded compliance requests against a 30-day Shopify workflow target

7-day free trial. No card required.

  • Everything in Solo
  • Up to 3 apps on one account
  • Combined dashboard across apps
Start free trial

Team

Need more than three apps?

Custom

4+ apps on one account

Contact us

Overview

How Delink works

Mandatory webhooks, setup timeline, workflow roles, optional Forward relay, and retention — plus optional uninstall monitor on every plan. Quick start guide.

Read overview

FAQ

Shopify compliance webhook failures — and how to fix them

Answers on mandatory privacy webhooks, HMAC verification, app review, workflow tracking, and how Delink helps Shopify app developers.

Why are my Shopify mandatory compliance webhooks failing?
Automated checks and app review often report must implement mandatory compliance webhooks, could not reach webhook endpoint, or webhook endpoint returned non-200. Usually the endpoint is unreachable, compliance_topics is missing from shopify.app.toml, or HMAC verification rejects the payload. Shopify requires customers/data_request, customers/redact, and shop/redact to return 200 on valid requests and 401 when X-Shopify-Hmac-Sha256 is invalid.
What does Shopify webhook HMAC verification failed mean?
HMAC failure or HMAC validation failed means the signature on the raw request body does not match your app client secret. Common causes: parsing JSON before verifying, wrong secret, middleware altering the body, or comparing against transformed bytes. Delink verifies HMAC on the raw body and returns 401 on invalid signatures.
How do I fix compliance_topics in shopify.app.toml?
Add a [webhooks] compliance_topics block pointing at your Delink per-app webhook URL, then run shopify app deploy so app-specific webhooks register on your Partner app version. Automated review checks that all three mandatory compliance topics are configured — not just generic admin API webhooks.
Does Delink work with non-Remix Shopify apps?
Yes. The TOML snippet is Shopify CLI configuration — not a Remix-specific file. It works with any Shopify CLI app that has shopify.app.toml: Remix, Next.js, Node/Express, Rails, PHP, and others. Delink's snippet uses an absolute HTTPS webhook URL, so Shopify sends compliance payloads to Delink directly — your app does not need compliance webhook routes. You do need a CLI-managed app with shopify.app.toml and shopify app deploy; legacy apps without that file need a different registration path.
Do I need to change api_version in shopify.app.toml for Delink?
No. Delink's snippet omits api_version on purpose — keep the [webhooks] api_version your app already uses. Shopify requires that field for all app-specific subscriptions in the file; it controls payload serialization for your webhooks, not Delink's ingest. Compliance payloads (shop_id, shop_domain, customer, orders_to_redact) have been stable across supported versions, and Delink verifies HMAC on the raw body without calling Shopify's Admin API. Paste Delink's [[webhooks.subscriptions]] blocks under your existing [webhooks] section and run shopify app deploy — do not change api_version just for Delink.
Shopify app review: must implement mandatory compliance webhooks — how do I fix it?
Register all three compliance_topics in shopify.app.toml pointing at your Delink webhook URL, run shopify app deploy, and confirm the endpoint is reachable over HTTPS. Automated review also checks that you must verify webhook HMAC signatures — valid payloads return 200, invalid X-Shopify-Hmac-Sha256 returns 401. Delink's Setup tab provides the TOML snippet and webhook test tool.
Why is my Shopify compliance webhook returning 401?
Shopify webhook returned 401 Unauthorized is correct when HMAC verification fails — reject unsigned or tampered requests. If valid Shopify traffic gets 401, double-check the shpss_… client secret in Delink matches the app and no proxy rewrites the body. Use Test webhooks in the console to confirm 200 plus a log entry.
How do I rotate my Shopify client secret with Delink?
Rotate the secret in Shopify first (Dev Dashboard → Apps → your app → Settings → Client secret), then open your app in Delink and use Update client secret to save the new shpss_… value. Delink cannot restore the previous secret — if you paste the wrong value, rotate again in Shopify and update Delink. After a rotation, the app shows HMAC verification pending until Shopify delivers the next production compliance webhook signed with the new secret.
What happens when a Shopify compliance webhook delivery fails?
Shopify retries failed deliveries. If your endpoint is down, times out, or returns 5xx, events may be missed — at launch or on live stores. Delink acknowledges valid requests with 200, writes an event record and audit entry after successful verification and persistence. Network, infrastructure, invalid-signature, or database failures can prevent a record from being created.
How does Delink help at launch and with live compliance requests?
At launch, Delink gives you HMAC-verified ingest for all three mandatory compliance webhooks, a ready-made shopify.app.toml snippet, and a webhook test tool for automated review checks. The production design uses that endpoint for valid requests that reach Delink and are successfully verified and persisted, with a 30-day workflow clock, daily digest email, complete / reopen workflow, and exportable compliance event record export on every plan. You still own fulfillment in your app — Delink records that each request was received and tracked.
Do I need to host my own Shopify compliance webhook endpoint?
You need a public HTTPS endpoint that meets Shopify's compliance requirements — but you do not have to build it yourself. A minimal self-hosted endpoint often costs more once you add HMAC, audit logging, and uptime. Delink is hosted: register your app, copy the webhook URL, deploy the TOML snippet, and point Shopify at Delink. If you already have a handler, optional Forward forwards the same signed payload to your URL after Delink verifies it — included on Solo and Multi.
What is Delink Forward?
Forward is an optional per-app relay included on every plan. After Delink verifies a compliance webhook, we POST the exact same request Shopify sent — raw body, HMAC, X-Shopify-* headers, and User-Agent — to an HTTPS URL you configure, plus X-Delink-Event-Id. We never store the raw body. If your endpoint fails, Shopify retries; Delink tracks Forward status in the event log. Compliance topics and console test events only — not app/uninstalled.
What are Forward retry and timing expectations?
Delink POSTs to your Forward URL with a 2 second timeout. Your endpoint must return 2xx for Delink to mark the event delivered and ack Shopify. Delink does not queue payloads — Shopify retries when Forward fails. Delink tries Forward again on each Shopify redelivery, up to 4 attempts per webhook ID. On attempts 1–3, a failed Forward returns 502/504 to Shopify so it retries. On attempt 4, Delink acks Shopify even if your URL still fails, and that payload cannot be forwarded again. We email you on the first failure and when retries are exhausted.
Does Forward work with localhost?
No. Forward requires a public HTTPS URL — localhost and private IPs are rejected. Use whatever public endpoint your handler already exposes in dev or production. If that URL changes, update the Forward URL in the console.
When am I charged for Delink?
Sign up with no card required. 7-day free trial. No card required. Subscribe in Stripe when you're ready; plans renew monthly until canceled.
How long does Delink keep compliance event data?
During early access, the following retention schedule applies to production compliance events received through the Service. Compliance events remain visible through 90 days after the workflow due date on all plans, then are hidden and queued for deletion by the weekly retention job. Actual deletion can occur on the next successful job run. If your subscription ends, console access is blocked and event data is scheduled for deletion after a 30-day resubscription period. Uninstall monitor events use the same grace period from receipt (90 days after the workflow due date).

Still stuck on compliance webhooks or HMAC errors? Email support or start free trial on Solo.