Shopify integration — products, customers and orders, read-only

The Shopify integration brings your store’s products, customers and orders into Oneop so the chatbot and your agents can answer order questions without a second browser tab. It reads your store. It does not write to it, and the limits section below is worth reading before you assume parity with the WooCommerce integration.

What it does

Installs over OAuth. You start the install from integrations settings with your *.myshopify.com domain — the format is validated before the redirect — and Shopify sends you back with a code that is checked against a nonce held in your session, so an install callback you did not initiate is rejected. Oneop requests four scopes and no more: read products, read customers, read orders, and write webhooks.

Registers its own webhooks. On install, Oneop creates four webhooks on your store — order created, order updated, customer created, product updated — pointed at its own endpoint. You do not configure them by hand.

Verifies every inbound event. Each webhook is checked with an HMAC-SHA256 signature against a secret generated per connection at install time, compared in constant time. A missing signature, a bad signature, an unknown shop domain, or a connection with no stored secret is refused with a 401. A forged “order paid” event does not touch your data.

Mirrors three record types. Products, customers and orders are pulled from your store and stored in Oneop, refreshed on demand and kept current between refreshes by the webhooks above. Orders carry status, financial and fulfilment state, totals, line items, discounts, shipping, and billing and shipping addresses.

Answers from store data inside a chat. Chatbot flows can search the mirrored products and orders during a conversation, so “where is my order” and “do you sell this” can be answered without a handoff.

What syncs, in which direction

• Shopify → Oneop: products, customers, orders.
• Oneop → Shopify: nothing. The only thing Oneop writes to your store is the four webhook registrations at install time. No order, customer, product, inventory level, refund or fulfilment is ever created or modified by Oneop.
• Not synced: inventory levels and locations, fulfilments and shipments, refunds and returns, discounts as objects, draft orders, collections, metafields, and Shopify’s own customer accounts. Payouts and finance objects are out of scope entirely.

Setup

Connect per workspace from integrations settings. The access token and the webhook secret are stored per workspace and never returned by the API. Products, customers and orders load on first request and can be re-pulled on demand; the webhooks keep the mirror current in between. Disconnecting removes the stored credentials.

What it does not do

• There is no stock check. This is the one place Shopify is behind WooCommerce, and it matters: the WooCommerce integration has a live stock endpoint the chatbot can call, and Shopify does not. A product’s stock figure arrives only as part of a product record — from the last pull or the last product-updated webhook — so it is a snapshot, not a live reading. Do not build a flow that promises real-time availability on Shopify.
• It is read-only. WooCommerce can cancel an order and process a return from inside a chat. Shopify cannot. There is no write path back to your store at all.
• Pulls fetch the first 250 records only. There is no pagination, so a catalogue or order history larger than that is not fully mirrored by a pull. Webhooks fill the gap going forward, not backwards.
• Nothing lands in Oneop’s inventory or finance modules. The mirrored data lives in its own tables. Shopify orders do not become Oneop sales orders, invoices, or stock movements, and your store remains the system of record.
• Order and customer deletions are not received. The registered webhooks cover creates and updates only, so a record deleted in Shopify stays in the mirror until you re-pull.
• No automated test coverage. This integration has no tests in Oneop’s suite. It is exercised by hand, and saying so is more useful than implying a safety net that is not there.

Related module and plan notes

Works with the AI chatbot, available on every plan. If live stock checks and in-chat cancellations and returns are what you actually need, WooCommerce is the storefront integration that has them today.