Skip to main content

​
Abandoned Cart Pro webhooks

​
Outbound recovery webhooks

Available to Advanced merchants, who configure an HTTPS endpoint in Settings. The app sends signed POST requests on recovery events. The X-DraftRecover-Signature header is an HMAC-SHA256 signature of the raw request body using the secret shown when the endpoint was configured. Delivery uses at-least-once retry semantics, bounded to five attempts. It is not exactly once: a process can receive a successful response and exit before recording that result, so the same logical event can be sent again. Receivers must:
  1. Verify the signature.
  2. Deduplicate on the stable (shop, event, resourceId) identity before applying side effects.
  3. Return a successful 2xx only after both the side effect and the deduplication record are durable.
Do not use the per-attempt createdAt value as the deduplication key; it is generated for each attempt.

​
Recovery events

The outbound event payload identifies the shop, the event name, and the resource. Advanced also forwards these events to Klaviyo when a merchant key is configured:
  • recovery.sent
  • recovery.converted
  • quote.followed_up
  • invoice.chased

​
Shopify webhook subscriptions

The app subscribes to Shopify topics declaratively. The receiving route verifies delivery through the Shopify SDK. The handler also implements customers/create and customers/update for visitor-identity sync, but those protected-customer-data topics are intentionally not subscribed until Shopify grants the required access. Unknown topics are acknowledged with HTTP 200 to prevent retry storms and logged with structured output. Completed duplicate deliveries are acknowledged without repeating mutations; an in-progress duplicate receives HTTP 503 with Retry-After: 30. Pcnaid Documentation › Shopify Ecosystem › Abandoned Cart Pro › Developer