Build or Buy Webhook Reliability and Replay on Shopify?
Webhook reliability and replay on Shopify is a BUILD: Shopify retries a failed delivery 8 times over 4 hours, then stops. A longer ERP or gateway outage loses orders unless you own a durable queue with replay. Adding the layer to an existing integration costs $10,000–$30,000 (Deploi estimate, illustrative). The two App Store options carry 0 and 9 reviews; Celigo and Workato are quote-only iPaaS platforms. Customize when an iPaaS already carries the pipe.
Your profile — see how the verdict shifts
- Confidence
- High — Shopify's own changelog states webhooks are retried 8 times over 4 hours and then stop, which is exactly the outage length in the trigger scenario. Checked the App Store: two listings do genuine webhook monitoring and retry, Webhook Guard (0 reviews, brand new) and Cloudhooks (9 reviews), and neither documents event durability across a multi-hour downstream outage. Celigo and Workato have no App Store listing; they are iPaaS platforms reached directly, priced by quote.
- Reference scenario
- $20M–$100M GMV · custom Shopify → ERP or WMS order sync over webhooks · 500–10,000 orders a day at peak · agency or in-house dev bench
- As of
- September 2026
Decision at a Glance
| Your profile | Verdict | Why |
|---|---|---|
| Every integration is an installed app | WAIT | The app vendors own their endpoints and their retries; your exposure is their uptime, not your code. Nothing to build. Ask each vendor in writing how they handle a gap longer than Shopify's 4-hour retry window. |
| One custom integration, under ~500 orders a day | CUSTOMIZE | A monitoring app turns a silent failure into an alert; Webhook Guard's free tier covers 5K events a month (verified Sep 2026). Write the reconciliation query yourself and replay by hand, and accept that the alerting vendor has 0 reviews. |
| Custom ERP or WMS sync, 500–10,000 orders a day | BUILD | A 4-hour gap at this volume is hundreds of orders. A durable queue with dead-letter replay plus an hourly reconciliation query costs $10,000–$30,000 (Deploi estimate, illustrative) and removes the failure mode instead of announcing it. |
| iPaaS already in place (Celigo, Workato) | CUSTOMIZE | The platform persists and replays events on its own clock, independent of Shopify's 4 hours. Configure its dead-letter handling deliberately and add the reconciliation query it doesn't run for you. |
What Webhook reliability and replay Actually Drives
| Outcome | Impact | How it works |
|---|---|---|
| Operational efficiency | High | Orders reach fulfillment even when the ERP is down for six hours, because the queue holds them and replays in order; the Monday-morning hand reconciliation stops existing. |
| Customer experience | High | A shopper whose order fell into the gap gets a late shipment and opens a 'where is my order' ticket; automated replay closes the gap before the shopper notices there was one. |
| Data & insight | Medium | A log of every delivery, accepted or dead-lettered, is the audit trail finance needs when Shopify and the ERP disagree by 40 orders at month-end. |
| Revenue — indirect | Low | Fewer non-delivery refunds, chargebacks and support tickets after an incident; the direct revenue was already captured at checkout. |
Spend ceiling: Size the spend to the cost of one bad afternoon: orders per hour times four hours of silence, plus the support load that follows. At 100 orders an hour that is 400 orders per outage, and the build is cheaper than the second one.
What buying enables (top apps)
- + Alerts within minutes when deliveries fail, with a log of what fired and what didn't
- + A manual retry from a dashboard, no code required
- + Cloudhooks: a managed runtime for small webhook-driven automations with automatic retries and no server to run
- + iPaaS platforms: event persistence and replay independent of Shopify's 4-hour clock, for teams already paying for one
What building additionally unlocks
- + Events that survive any outage length, replayed in order after the downstream system recovers, without a human
- + A reconciliation query that catches what no webhook ever announced
- + No 0-review vendor in the path of every order, and no order payload leaving your infrastructure
- + One ingestion layer serving every downstream system, with stale-payload detection on X-Shopify-Triggered-At
Find Your Verdict in 3 Questions
Does any custom integration (ERP, WMS, 3PL) depend on Shopify webhooks to receive orders?
Yes: Go to question 2.
No: Your verdict: WAIT — installed apps own their own endpoints and retries; ask each vendor in writing how they handle a gap longer than 4 hours and move on.
Does an iPaaS such as Celigo or Workato already carry that integration?
Yes: Your verdict: CUSTOMIZE — configure its dead-letter handling deliberately and add the hourly reconciliation query it doesn't run for you.
No: Go to question 3.
Would a 4-hour gap in order flow cost you more than a week of dev time?
Yes: Your verdict: BUILD — a durable queue, dead-letter replay and an hourly reconciliation query; Shopify stops retrying after 8 attempts over 4 hours.
No: Your verdict: CUSTOMIZE — add a monitoring app for alerts, write the reconciliation query yourself and replay by hand when the alert fires.
The TCC Scorecard — 12 Dimensions
TCC — Total Cost of Capability: what it actually costs to have this capability over three years, whichever way you get it. Each dimension is scored 0–5 for both paths. How we score →
| Dimension | Buy | Build | Why |
|---|---|---|---|
| Cost | |||
| Acquisition & implementation | A monitoring app is wired to your endpoints in an afternoon; a queue, dead-letter store and replay path add $10,000–$30,000 to an existing integration (Deploi estimate, illustrative). | ||
| Recurring fees | Webhook Guard runs $0–$199/mo plus event overages and Cloudhooks bills $0.01 per action (verified Sep 2026); the build's recurring cost is queue hosting measured in tens of dollars plus upkeep. | ||
| Maintenance & upgrades | The app vendor tracks Shopify's webhook changes; your layer needs an API version bump each year and a quarterly forced-failure drill to prove replay still works. | ||
| Switching & exit | A monitoring app sits beside the flow and unplugs cleanly; a queue you own has no exit at all, since every downstream system already reads from it. | ||
| Risk | |||
| Vendor risk | The two listings carry 0 and 9 reviews (verified Sep 2026), and one of them would sit in the path of every order; a brand-new vendor in that position is the risk you were trying to remove. | ||
| Security & compliance surface | A third-party webhook proxy or runtime sees every order payload, including customer PII; your own queue keeps that data inside infrastructure you already govern. | ||
| Platform-deprecation exposure | Shopify's retry schedule changed once already (2024-09-10) and endpoint changes don't redirect in-flight retries; a layer you control adapts on your schedule, an app on the vendor's. | ||
| Value | |||
| Fit to requirement | The requirement is that no order is lost during a 6-hour ERP outage; monitoring apps tell you it happened, and only a durable queue with ordered replay prevents it. | ||
| Time to market | Alerts this week versus 2–4 weeks for the queue and replay path on an existing integration (Deploi estimate, illustrative). | ||
| Performance & scale | A managed queue absorbs a Black Friday burst without back-pressure on Shopify's delivery; per-event app pricing scales your bill with the same burst. | ||
| Data ownership & AI-readiness | Every raw delivery, accepted or dead-lettered, is an event log you own; it doubles as the audit trail when Shopify and the ERP disagree by 40 orders. | ||
| Focus & opportunity cost | Two to four weeks of platform work on infrastructure nobody sees; the payoff is the outage that never becomes a Monday-morning reconciliation. | ||
The App Landscape
| App | Status | Pricing | Best for |
|---|---|---|---|
| Webhook Guard | Live — flagged — 0.0★, 0 reviews; brand-new listing. Monitors, retries and troubleshoots webhooks: detects failed, delayed, duplicate and invalid events, forwards to multiple endpoints and keeps audit logs. Deliveries pause when the free tier's event cap is reached; no durability guarantee across a multi-hour downstream outage is documented | Free $0/mo for 5K events · Starter $29/mo for 25K events plus $5 per extra 10K · Growth $79/mo for 150K events plus $10 per extra 50K · Pro $199/mo for 750K events plus $15 per extra 100K (verified Sep 2026) | Visibility and a manual retry button on a low-volume custom integration |
| Cloudhooks | Live — flagged — 5.0★, 9 reviews; Built for Shopify; young listing. Serverless webhook infrastructure with logging and retries for custom automations and external API calls; it does not document duplicate-delivery or idempotency handling, so the dedup step is still yours to write inside the action | Free to install; actions 1–100 free, actions 101–50,000 at $0.01 each, actions above 50,000 at $0.005 each (verified Sep 2026) | A cheap managed runtime for small automations, where the dedup and replay logic is still yours to write |
| Celigo (integrator.io) | Live — Ecommerce-centered iPaaS; the default managed-connector choice in Shopify-to-ERP stacks | Endpoint/flow-tiered platform subscription | Finance-led ERP integrations where the business already pays for a managed pipe |
| Workato | Live — Enterprise automation platform; strongest when integrations span the whole business, not just the store | Recipe/task-based tiers | Organizations standardizing every integration on one iPaaS, with Shopify as one endpoint among many |
| Durable ingestion layer (custom) | Build lane — A thin receiver that acknowledges and enqueues, a dead-letter store with ordered replay, stale-payload detection on X-Shopify-Triggered-At, and an hourly reconciliation query against the Admin API as the backstop | $10,000–$30,000 added to an existing integration; $30,000–$60,000 standalone with a replay console (Deploi estimate, illustrative) | Any custom order sync where a 4-hour gap costs more than a week of dev time |
The Build Path
- Acknowledge-and-enqueue receiver: The endpoint verifies the HMAC, writes the raw payload and headers to a durable queue and returns 200 at once; processing happens downstream, so Shopify never sees a slow ERP as a failed delivery.
- Dead-letter queue with ordered replay: Downstream writes that fail land in a dead-letter store with the original payload and X-Shopify-Triggered-At; after the ERP recovers, an operator replays them in order, re-fetching current state where the payload is stale.
- Hourly reconciliation query: A scheduled job compares orders created or updated in Shopify over the last window against the downstream system and re-fetches any gap through the Admin API, because after 4 hours no redelivery is coming.
- Optional: event-bus delivery: Point the webhook subscriptions at Amazon EventBridge or Google Cloud Pub/Sub instead of your own HTTPS endpoint, so the durable buffer is managed infrastructure and your receiver's uptime stops being part of the problem.
- Effort band
- $10,000–$30,000 added to an existing integration; $30,000–$60,000 as a standalone ingestion layer with a replay console — Deploi estimate (illustrative); lands in the $10–25K or $25–75K contact-form band
- Typical timeline
- 2–4 weeks on an existing integration; 6–10 weeks for a standalone layer (Deploi estimate, illustrative); run old and new endpoints side by side during cutover, because in-flight retries don't follow an address change
- Maintenance, honestly
- ~15–20% of build cost per year (Deploi estimate): roughly $1,500–$12,000/yr (Deploi estimate, illustrative), mostly an annual API version bump and a quarterly forced-failure drill that proves replay still works. There is no subscription line.
- What you own — and what you take on
- You own: the event log, the replay path, the reconciliation report and the alerting thresholds. You take on: the quarterly drill, and keeping the dead-letter retention longer than the longest outage your logs have ever shown.
3-Year Total Cost of Capability
| Buy (app path) | Build (custom path) | |
|---|---|---|
| Year 0 (setup) | $500–$3,000 (wiring and alert setup) | $10,000–$30,000 |
| Years 1–3 (recurring) | $1,000–$7,200 (monitoring tiers) | $4,500–$18,000 (maintenance) |
| 3-year total | ≈$1,500–$10,200 | ≈$14,500–$48,000 |
- † All figures illustrative samples for the reference scenario — not quotes, not verified pricing.
- † App path: Webhook Guard at the Starter-to-Pro tiers held flat, plus a few hours of endpoint wiring; the human time spent replaying by hand after each incident is not costed.
- † Build path: the layer added to an existing integration, three-year horizon, upkeep at 15–20% of build cost per year; the cost of orders lost in an outage sits outside both columns.
What the Sticker Price Hides
On the buy path
- — Per-event pricing scales with the same traffic burst that stresses the pipe; Webhook Guard's overages run $5–$15 per block above each tier (verified Sep 2026), and the free tier pauses deliveries at its cap
- — Monitoring tells you an event failed; someone still has to replay it, and after 4 hours the replay source is the Admin API, not Shopify's redelivery
- — A 0-review vendor in the path of every order is a new single point of failure dressed up as a safeguard
- — iPaaS pricing by endpoints and flows grows with every new system you connect; the quote you got for one ERP is not the quote for three
On the build path
- — Dead-letter retention shorter than your longest outage means replay has nothing to replay; size it from your incident log, not from a default
- — Changing the webhook endpoint address mid-cycle strands in-flight retries; run old and new endpoints concurrently during any migration
- — Replaying a stale payload over a newer state corrupts the ERP record; stale-payload detection is not optional
- — ~15–20% of build cost per year in upkeep (Deploi estimate)
What Merchants Say
Orders vanished for a four-hour window during an ERP maintenance run and nobody knew until a customer asked where the package was; Shopify had retried and given up hours earlier.
The 1–2★ shape on integration and automation apps: retries happen, but the log doesn't say what was retried or whether it landed, so proving an order reached the ERP still means checking by hand.
If You Change Your Mind Later
If you bought and outgrow it
A monitoring app unplugs cleanly because it sits beside the flow rather than in it; you lose the audit log and alert history, so export both before you cancel. An iPaaS exit is a re-implementation of every flow it carried, priced in months rather than days.
If you built and want out
There is no exit to plan, because every downstream system already reads from the queue you own; a future iPaaS or app simply becomes one more consumer of it. The event log stays yours, and the reconciliation query keeps working against whatever replaces the ERP.
When This Answer Changes
We're watching for:
- ▸ Shopify extending the webhook retry window beyond 8 attempts over 4 hours (the schedule announced 2024-09-10 still stands as of September 2026)
- ▸ Webhook Guard passing the 30-review mark, or Cloudhooks documenting replay after downstream recovery rather than only automatic retries
- ▸ Celigo or Workato publishing a Shopify App Store listing with a published price
Verdict change log:
No changes since first publication (September 2026).
Common Questions
How long does Shopify retry a failed webhook?
Shopify retries a failed webhook delivery 8 times over 4 hours on an exponential backoff schedule, then stops (per Shopify's changelog, September 2024). A payment-gateway or ERP outage that lasts longer than 4 hours therefore loses every order event that fired during the window. Retries redeliver the original trigger-time payload, so check the X-Shopify-Triggered-At header and re-fetch current state before writing.
Do Webhook Guard or Cloudhooks replay webhooks after a long outage?
Neither listing documents a guarantee that events survive a multi-hour outage. Webhook Guard monitors deliveries, detects failed, delayed, duplicate and invalid events and offers a retry, from a free 5K-events-a-month tier to $199/mo for 750K events (verified Sep 2026). Cloudhooks runs your automation code with logging and automatic retries at $0.01 per action after the first 100 (verified Sep 2026). The two listings carry 0 and 9 reviews; treat them as visibility, not durability.
What does a durable webhook ingestion layer cost to build?
A durable ingestion layer adds $10,000–$30,000 to an existing integration (Deploi estimate, illustrative): a thin acknowledge-and-enqueue receiver, a dead-letter queue with ordered replay and an hourly reconciliation query against the Admin API. A standalone layer with a replay console runs $30,000–$60,000 (Deploi estimate, illustrative). Upkeep is roughly 15–20% of build cost a year (Deploi estimate), mostly an API version bump and a quarterly forced-failure drill.
Your Next Steps
If you're going with BUILD(matches your selected profile)
- Pull your incident history and find the longest downstream outage; that number sizes dead-letter retention
- Split the receiver: verify HMAC, enqueue, return 200; move all processing behind the queue
- Add the dead-letter store with X-Shopify-Triggered-At on every record and an ordered replay command
- Schedule the hourly reconciliation query against the Admin API and alert on any gap
- Run a forced-failure drill before peak: take the ERP down for six hours in staging and prove zero orders are lost
If you're going with CUSTOMIZE
- Wire a monitoring app to every custom endpoint and route its alerts to the on-call channel, not an inbox
- Write the reconciliation query yourself; the app will not run it for you
- Document the manual replay procedure, including the 4-hour cutoff after which the Admin API is the only source
- Diary a re-decision when daily order volume doubles or a second custom integration arrives
Official Docs & Sources
- Changelog: updates to the webhook retry mechanism — shopify.dev
- Webhooks (shopify.dev) — shopify.dev
- GraphQL Admin API — shopify.dev
Official documentation linked for verification — our verdicts and estimates are our own.
Related Decisions
Build or Buy an Admin Activity Audit Log on Shopify?
Shopify records who signed in, never who changed a price. No app provides a field-level admin audit log, which makes this a build or nothing at all.
Build or Buy API and Webhook Deprecation Tracking on Shopify?
Shopify warns the whole world when an API version sunsets. Nothing tells you which of your own integrations still depends on it, and no app fills that gap.
Build or Buy API Rate-Limit and Throttling Management on Shopify?
No app manages Shopify Admin API rate limits across the apps on a store. Each app gets its own plan-sized bucket; your integrations need a rate-aware queue you own.
Build or Buy Checkout Extension and Theme App Conflict Debugging?
No app detects two Shopify apps fighting over the same extension point or cart drawer. The fix is a bisect runbook, an app register and a synthetic monitor you own.
Build or Buy Performance Monitoring & App Audits on Shopify?
Measurement is free on Shopify; storefront speed comes from an audit-and-remediation program, not a speed app.
Ready to make a 6-hour outage a non-event?
We'll put a durable queue, dead-letter replay and a reconciliation backstop in front of your ERP or WMS sync, and run the first forced-failure drill with you.
Contact us todayVerdict scored for the reference scenario above. Estimates are not quotes; app pricing carries its verification date and gets re-verified quarterly. Full scoring anchors: see the TCC methodology.
Read how we score these decisions (the TCC Framework). No affiliate links, no paid placement — no app vendor pays to appear here.