The developer docs currently suggest using Event ID as an idempotency key:
“Handling duplicate webhooks”
In rare instances, your app may receive the same webhook event more than once. Shopify recommends detecting duplicate webhook events by comparing theX-Shopify-Event-Idheader to previous events’X-Shopify-Event-Idheader.
How long do we need to persist the event ID for? Are we safe to drop it after 24 hours given the docs say the retry time is 4 hours?:
“Shopify will always try to re-deliver your webhooks even if they are failing”
Shopify waits five seconds for a response to each request to a webhook. If there’s no response, or an error is returned, then Shopify retries the connection 8 times over the next 4 hours. If there are 8 consecutive failures, then the webhook subscription is automatically deleted if it was configured using the Admin API.
Cheers
Luke