Forcing webhook uninstall via 404 not working as expected

Webhooks and Events
1

We have a deprecated service that’s still the handler for a couple of our Shopify webhooks. Context:

  • Around 100 merchants are still pointing to this old handler.

  • For many of them, locating a valid shop token in our system is difficult (some are outdated or missing in the DB due to past failures).

  • We moved these webhooks to be managed by TOML, so the info is not being lost in our system for any merchant.

My plan was to have the handler return a 404, which (as per Shopify docs) should cause Shopify to automatically remove/uninstall those webhooks for the affected shops.

The problem:

  • I do see 404 responses logged (in my service and the partner dashboard).

  • I do see retries happening (e.g. attempts #7, #8, etc.).

  • But even after a week, I’m not seeing the webhooks being removed from the affected merchants.

Has anyone else run into this? Does Shopify reliably uninstall webhooks after repeated 404s, or could this be a reporting issue on my end? Any insights would be super helpful :folded_hands:

2

Hey @Ishaan_Shettigar,

Thanks for reporting this. Just to confirm, you’re seeing more than 8 failures without the webhooks being removed?

Have you tried running a delete mutation to remove the API created webhooks? webhookSubscriptionDelete - GraphQL Admin

3

Hey @KyleG-Shopify ,

I am seeing 7 and 8 attempts, yes, but I’m not seeing the webhook being removed. Is there a reason why? The webhook gets fired again with a different payload, and then it just keeps happening, and I can’t seem to figure out why they’re not getting uninstalled.

For the aforementioned 100 merchants, locating a valid shop token in our system is difficult. So I figured Shopify would just remove these webhooks for them if the attempts = 8, but its been a week and only around 2-3 merchants’ webhooks have been removed. I’m seeing a lot of failed attempts in the dev dashboard but no webhooks being removed.

4

Thanks for sharing that @Ishaan_Shettigar. That is strange that they aren’t being removed after 8 attempts.

I would suggest for next steps to reach out to our support team directly and share a few examples of webhooks (subscription ID’s and specific webhook id’s) that failed this many times but weren’t deleted. That will help us locate this better in our logs to see why this is happening.

1 Like
5

Thank you so much Kyle, I’ll contact Shopify support.

1 Like
6

This is happening with my app as well. @Ishaan_Shettigar Did you resolve the problem on your end? We had a few early users of the app and didn’t realize we needed to deregister webhooks manually before dumping their token after uninstall.

Are there any official docs around the 404 specification?

7

Hi Griffin, we ran into something similar last year and it was frustrating to debug.

One thing that tripped us up: the 8-failure counter resets if the webhook successfully delivers even once between failures. So if you’re returning 404 but occasionally your endpoint comes back up or responds with 200 for any reason, the counter starts over. In Ishaan’s case, mentioning “the webhook gets fired again with a different payload” suggests new events are triggering new delivery attempts, and if any of those succeed, it resets everything.

For the lost token situation, there’s an awkward workaround that helped us. If those merchants still have your app installed, you can use the OAuth flow to re-authenticate and get a fresh token, then run the webhookSubscriptionDelete mutation. If they’ve already uninstalled, you’re unfortunately stuck waiting for Shopify’s cleanup or reaching out to support with specific subscription IDs like Kyle suggested.

Going forward, the pattern that saved us a lot of headache was storing the webhook subscription IDs when we create them, and running the delete mutations as the very first step in our app/uninstall handler before we clear any tokens. Shopify’s docs on the app lifecycle cover this but its easy to miss (Track Flow lifecycle events)

For official docs on the 404 behavior, there’s not much detail beyond what’s in the webhook delivery docs. The 8-attempt deletion is mentioned but the edge cases around counter resets aren’t really documented anywhere I’ve found. Support is probably your best bet for the specific subscription IDs that seem stuck.

1 Like