Orders/paid webhook silently ignored in toml despite read_orders scope, protected data approved, and successful deploy — React Router template

Hi Shopify team,

I’ve been debugging this for several days and wanted to share a complete picture of everything I’ve tried, hoping someone can identify the exact root cause.

Summary of the problem

The webhook orders/paid declared in shopify.app.toml is silently ignored by Shopify. The other two webhooks in the same toml (app/uninstalled and app/scopes_update) register and work correctly. orders/paid does not appear in shopify webhook trigger topic list, does not fire on real checkouts, and does not appear registered in Partner Dashboard.

Environment

  • Template: Shopify React Router (JavaScript)
  • Package: @shopify/shopify-app-react-router/server v13.0.0
  • Shopify CLI: latest
  • App distribution: Managed installation
  • API version declared in toml: 2026-07
  • Dev store: my-development-store.myshopify.com
  • App name in Partners: filu-app-chile

My full shopify.app.toml

client_id = “REDACTED”
name = “filu-app-2026”
application_url = “placeholder-url”
embedded = true

[build]
automatically_update_urls_on_dev = true
include_config_on_deploy = true

[webhooks]
api_version = “2026-07”

[[webhooks.subscriptions]]
topics = [ “app/uninstalled” ]
uri = “/webhooks/app/uninstalled”

[[webhooks.subscriptions]]
topics = [ “app/scopes_update” ]
uri = “/webhooks/app/scopes_update”

[[webhooks.subscriptions]]
topics = [ “orders/paid” ]
uri = “/webhooks/orders/paid”

[access_scopes]
scopes = “read_products,write_products,read_orders,read_customers,write_metaobjects,write_metaobject_definitions”

[auth]
redirect_urls = [ “placeholder-url/api/auth” ]

My shopify.server.js (complete, unmodified from template)

import “@shopify/shopify-app-react-router/adapters/node”;
import {
ApiVersion,
AppDistribution,
shopifyApp,
} from “@shopify/shopify-app-react-router/server”;
import { PrismaSessionStorage } from “@shopify/shopify-app-session-storage-prisma”;
import prisma from “./db.server”;

const shopify = shopifyApp({
apiKey: process.env.SHOPIFY_API_KEY,
apiSecretKey: process.env.SHOPIFY_API_SECRET || “”,
apiVersion: ApiVersion.October25,
scopes: process.env.SCOPES?.split(“,”),
appUrl: process.env.SHOPIFY_APP_URL || “”,
authPathPrefix: “/auth”,
sessionStorage: new PrismaSessionStorage(prisma),
distribution: AppDistribution.AppStore,
future: {
expiringOfflineAccessTokens: true,
},
…(process.env.SHOP_CUSTOM_DOMAIN
? { customShopDomains: [process.env.SHOP_CUSTOM_DOMAIN] }
: {}),
});

export default shopify;
export const apiVersion = ApiVersion.October25;
export const addDocumentResponseHeaders = shopify.addDocumentResponseHeaders;
export const authenticate = shopify.authenticate;
export const unauthenticated = shopify.unauthenticated;
export const login = shopify.login;
export const registerWebhooks = shopify.registerWebhooks;
export const sessionStorage = shopify.sessionStorage;

Everything I have tried (exhaustive list)

  1. read_orders confirmed in [access_scopes] block
  2. Protected Customer Data: Level 1 AND Level 2 approved in Partner Dashboard
  3. shopify app deploy completed successfully — output: “New version released to users. filu-app-chile-2”
  4. Uninstalled app completely from dev store admin
  5. Cleared all shopify.com cookies in browser
  6. Waited 10+ minutes after uninstall before reinstalling
  7. Reinstalled via shopify app dev + pressing p (multiple times across different days)
  8. Ran shopify app dev --reset and reconnected to existing app
  9. Multiple test checkouts via bogus gateway — terminal completely silent after payment
  10. Ran shopify webhook trigger with API version 2025-10:
    • app/uninstalled APPEARS in topic list
    • app/scopes_update APPEARS in topic list
    • orders/paid does NOT appear in topic list
  11. Handler file exists at app/routes/webhooks.orders.paid.jsx and compiles cleanly (zero errors in VS Code Problems panel)
  12. Checked Partner Dashboard for registered webhooks — none visible

The key diagnostic finding

When running shopify webhook trigger, I can confirm that app/uninstalled and app/scopes_update (the other two webhooks from my toml) DO appear in the topic list. But orders/paid does NOT appear, even though all three are declared identically in the same toml file.

This strongly suggests Shopify is reading the toml and registering the system webhooks but silently rejecting or ignoring the orders/paid subscription specifically.

What I have ruled out

  • NOT a handler code issue — file exists and compiles
  • NOT a scope issue — read_orders is declared and approved
  • NOT a protected data issue — Level 1 and Level 2 both approved
  • NOT a deploy issue — deploy completes with success message
  • NOT a reinstall issue — tried multiple clean reinstalls across different days
  • NOT a cache issue — tried --reset flag and cleared cookies

My specific questions

  1. Is there an additional configuration required for orders/paid specifically in managed installation apps beyond read_orders scope and protected data approval?

  2. Is there a known issue with orders/paid webhook registration in the React Router template with API version 2026-07?

  3. Could the placeholder application_url in my toml be causing Shopify to reject the orders/paid subscription silently? Note: shopify app dev correctly overrides this URL with the Cloudflare tunnel during development.

  4. Is there any internal log or diagnostic tool on Shopify side that could show why orders/paid is being rejected while the other two webhooks register correctly?

Thank you for any help. This is blocking my core app functionality.

Hi @kyle_liu,
Thank you for your response! I ran npm run deploy and it worked — new version released successfully (filu-app-chile-3).
However, I’m still having trouble receiving webhooks in my development environment. Here’s my full situation:
What works:
• npm run deploy :white_check_mark:
• Webhook manually triggered with CLI arrives to terminal :white_check_mark:
• orders/paid topic configured in shopify.app.toml :white_check_mark:
• When triggered manually, terminal shows: [FILU] Webhook recibido: ORDERS_PAID :white_check_mark:
The problems:

  1. When a real order is paid in my dev store, the webhook never arrives to my terminal automatically
  2. The Partner Dashboard shows nothing — Monitoring is blank, Event logs are blank, no webhook activity recorded anywhere
  3. Every time I restart npm run dev, the Cloudflare tunnel URL changes — so Shopify loses track of the endpoint
    My setup:
    @shopify/shopify-app-react-router
    • Cloudflare tunnel (trycloudflare.com) — URL changes on every restart
    • api_version = “2026-07” in shopify.app.toml
    • Webhook subscription configured:

[[webhooks.subscriptions]]
topics = [ “orders/paid” ]
uri = “/webhooks/orders/paid”

My questions:

  1. Why does the Partner Dashboard show no webhook activity at all — not even failed attempts?
  2. How can real order webhooks arrive automatically during development with a changing tunnel URL?
  3. Is there a way to fix/persist the tunnel URL, or should we use ngrok instead?
    Thank you very much for your help!

Hi @Franciscoaho

Regarding the first issue, I was unable to reproduce it. I use ngrok and can utilize a fixed ngrok URL.

I’m just used to using ngrok, so I haven’t looked into whether Cloudflare supports fixed URLs in depth.

Setup a cloudflare tunnel to your local machine.
I have done two tunnels 1) frontend 2) backend and it works flawlessly no changing urls.

you run it like this - shopify app dev --tunnel-url https://front-dev.yourdomain.com:3000