Shopify webhooks for inventory: real-time sync that doesn't drift
Why webhook-only inventory sync drifts, and the three layers (webhooks, catch-up and a nightly refresh) plus the duplicate and out-of-order safeguards that keep stock right.
Stokrio Team · · 8 min read
Shopify tells apps about changes through webhooks: small messages sent when an order is created, a product is edited or an inventory level changes. They are fast, which is why inventory apps use them. They are also not guaranteed to arrive once, in order, or at all. An app that trusts them blindly will slowly disagree with Shopify.
Key takeaways
- Treat webhooks as a fast hint, not as the source of truth.
- Layer them: webhooks for speed, a catch-up pull for anything missed, and a periodic full refresh for everything else.
- Make handlers idempotent: applying the same delivery twice must change nothing.
- For stock, read the current total from Shopify rather than applying a delta from the message.
The three layers
1. Webhooks, for speed. Orders, products and inventory changes are applied within moments of Shopify sending them. This is what makes stock and sales look live.
2. A catch-up pull, for gaps. Webhooks can be lost during an outage on either side. A scheduled catch-up job re-reads recent orders and products, so a missed message is repaired by the next run instead of never.
3. A nightly refresh, for drift. Once a day the whole catalogue is re-read and compared. This is the safety net that catches anything the first two layers did not.
Stokrio runs all three.
Duplicates: apply each delivery once
Shopify retries when your server is slow or returns an error, so the same delivery can arrive twice. Each webhook carries a unique id. Stokrio records the ids it has handled and acknowledges a repeat without applying it again. If processing fails, the claim is released so Shopify's retry is applied properly rather than dropped.
Out of order: don't apply deltas
Imagine two quantity changes sent a second apart that arrive in the wrong order. If you apply them as "set to the number in this message", the older one wins and stock is wrong until the next sync. The safer approach for stock is to treat the message as a signal and ask Shopify for the item's current total across locations. Stokrio does this, so a late or replayed event cannot roll stock backwards.
Whose message is it?
Shopify signs each webhook with your app's secret, and a correct signature proves it came from Shopify. It does not prove which store it was meant for, since the store is named in a header. Stokrio registers a separate signed callback address per store and checks it, so a message captured for one store cannot be replayed against another.
What to watch
- A webhook arriving for a store that has uninstalled: it should be acknowledged and ignored.
- A burst of inventory changes during an import: debounce reads so you do not hit rate limits.
- Time zones in order timestamps: store them in UTC and convert for display.
For the wider picture, see how embedded apps work and the Shopify app page.