I tried creating a webhook for reading orders, but I get unauthorized access response. This only happens when I am trying to trigger the webhooks from the browser but from the bash it seems to be working fine. I used the remix template to create the shopify app and added an entry to the shopify app config file. Rest of the code is in the routes. Can someone please suggest me the steps from the beginning on how to create a webhook in similar fashion.
I guess you are using Shop-specific webhooks.
Can you please check subscribing Shop-specific webhooks on Shopify app Remix?
application_url = "https://regulatory-spin-wooden-albuquerque.trycloudflare.com"
embedded = true
name = "meeeooww-store"
handle = "meeeooww-store"
[build]
include_config_on_deploy = true
automatically_update_urls_on_dev = true
[webhooks]
api_version = "2025-01"
[[webhooks.subscriptions]]
topics = [ "app/uninstalled" ]
uri = "/webhooks/app/uninstalled"
[[webhooks.subscriptions]]
topics = [ "app/scopes_update" ]
uri = "/webhooks/app/scopes_update"
[[webhooks.subscriptions]]
topics = [ "orders/create" ]
uri = "/webhooks/app/orders_create"
[access_scopes]
# Learn more at https://shopify.dev/docs/apps/tools/cli/configuration#access_scopes
scopes = "read_orders,write_orders, write_products"
[auth]
redirect_urls = [
"https://regulatory-spin-wooden-albuquerque.trycloudflare.com/auth/callback",
"https://regulatory-spin-wooden-albuquerque.trycloudflare.com/auth/shopify/callback",
"https://regulatory-spin-wooden-albuquerque.trycloudflare.com/api/auth/callback"
]
[pos]
embedded = false
Here is the toml file, I think this is correct.
Your shopify.app.toml is mostly there.
A couple of things to double-check: theuri values are correct as relative paths; on deploy the CLI will register each webhook at application_url + uri.
Your api_version = “2025-01” is valid, and orders/create will fire as long as the app is installed with read_orders (you’ve got it).
Make sure your server has POST handlers at exactly those routes and that you’re verifying the HMAC and returning a 200 within 5s, otherwise Shopify will retry and eventually disable the subscription (About webhooks)
If you’re using that Cloudflare tunnel in dev, every time the URL changes you need to redeploy or run shopify app dev so the CLI re-registers webhooks against the current application_url.
For production, keep a stable domain and include_config_on_deploy = true as you already have.
You can also run npm run deploy (or shopify app deploy --reset) to push the TOML-defined subscriptions, and use the CLI webhook trigger to test locally. Docs for the TOML [[webhooks.subscriptions]] block are here if you want tocompare line-by-line (App configuration)
If after this you still don’t see deliveries, log the raw request at /webhooks/app/orders_create to confirm it’s hitting your app and that the topic header matches. If this solves it, please mark as solution so others can find it faster.
