Why Shopify gets the best version of this
Shopify fires a webhook when a checkout is created and updated, not just when an order completes. That means genuine abandoned-cart recovery — reaching someone who entered their details and then hesitated, while they are still deciding. On Pro, that alone often pays for the subscription.
Create an app for your store in Shopify's Dev Dashboard
Since January 2026 Shopify no longer lets you create a connection from inside the store admin — the old “Develop apps” token screen is gone. It now happens in Shopify's Dev Dashboard, which you open from your own admin. You are creating a small private “app” that exists only to give AptoAir permission to read your orders. Nothing is published, reviewed or listed anywhere, and no approval is needed — Shopify grants a custom app on your own store access to customer details automatically.
- In your Shopify admin (signed in as the store owner) go to Settings → Apps, click “Develop apps”, then “Build apps in Dev Dashboard”. Start here rather than typing dev.shopify.com yourself — this opens the organisation that owns your store.
- Click “Create app” at the top-right. Under “Start from Dev Dashboard”, name it AptoAir and click Create.
- Open the “Versions” tab. Under URLs paste https://shopify.dev/apps/default-app-home as the App URL (a placeholder Shopify asks for). Choose the newest Webhooks API version. Under Access tick the scopes below. Click Release, then Release again.
- Click “Home” on the left. Under Installs click “Install app”, pick your store, click Install and approve what AptoAir may see.
- Click “Settings” on the left and copy the Client ID and the Client secret.
Required: read_orders, read_products, read_customers
For delivered notifications and tracking updates: read_fulfillments
Only if you want COD auto-cancel: write_orders
Abandoned checkouts need nothing extra — they come with read_orders
Two keys, and every webhook is verified
The Client secret does double duty: we use it to fetch short-lived access tokens from Shopify (they last 24 hours and we renew them ourselves), and Shopify uses the same secret to sign every webhook it sends us. So there is no separate “API secret” to hunt for — verification is automatic from the moment you connect.
- Every incoming webhook is checked with an HMAC signature before we act on it
- Access tokens expire daily and are renewed automatically — nothing for you to do
- Shopify shows the Client secret only once; if you lose it, generate a new one in the app's Settings and reconnect
What your customers start receiving
Order and checkout events become WhatsApp messages, sent as approved templates when the customer is outside the 24-hour window.
- Order confirmed, paid, shipped, delivered and cancelled updates — with the courier and tracking link
- Cash-on-delivery confirmation with Confirm / Cancel buttons before you ship
- Every buyer synced into your phonebook with spend, order count and automatic tags
- Your AI able to answer “where is my order?” with real, live data (Pro)
- Abandoned checkout followed up with the recovery link once the delay you set has passed (Pro)
- 1
Subscribe to Pro
Pro connects your store and adds cart recovery, AI store lookups and multiple stores.
- 2
Create the app in Shopify's Dev Dashboard
Shopify admin → Settings → Apps → Develop apps → Build apps in Dev Dashboard → Create app → name it, tick the scopes on the Versions tab, Release, then Install app on your store.
- 3
Copy the two keys
The app's Settings page shows a Client ID and a Client secret. Copy both.
- 4
Paste into Settings → Integrations
Your .myshopify.com address plus the two keys. We verify the keys, check every permission was really granted, register the webhooks and import your recent orders and products.
- 5
Map templates and test
Point each event at an approved template, then fire a test order to see the real result.
Store integrations, abandoned-checkout recovery, AI store lookups and multiple stores are all part of the Pro plan.
See plans