FULFILLMENT SERVICE APP: is callback url necessary? and can we skip "Accept a fulfillment request"

Retired Boards Appdev Fulfillment Api

Topic summary

Main issue: whether a fulfillment service must provide a callback_url and whether “Accept a fulfillment request” can be skipped; plus fulfilling orders not explicitly requested.

Key guidance provided:

  • callback_url is required today. It supports reactive notifications (new fulfillment requests, cancellations) and can be used to share tracking numbers and inventory levels with Shopify.
  • Accepting fulfillment requests is mandatory for fulfillment services to signal the merchant that fulfillment is in progress.
  • Fulfilling orders not requested (or assigned elsewhere) is possible only with write_third_party_fulfillment_orders, but that behavior is not expected for a fulfillment service. Merchants can auto-create requests via “Automatically fulfill the order’s line items.”

Recent update/consideration:

  • The team will consider making callback_url optional now that Fulfillment Order webhooks exist and can cover similar needs.

Concerns raised:

  • Callback delivery can’t be IP-allowlisted; some use a dummy endpoint and receive error notices, seeking a way to disable callbacks.
  • Callbacks are unauthenticated and hard to associate with a store, while webhooks are authenticated and integrate cleanly; some ignore callbacks and rely on webhooks.

Open items/status:

  • Which specific webhooks replace callback_url and how they address IP constraints remain unanswered. No final resolution; change under consideration.
Summarized with AI on January 20. AI used: gpt-5.
3

Hi Michael,

I have a similar issue. We manage our fulfilment internally and our B2C Shopify sites are a very small part of our business. As a result of having to move over to the ‘fulfillment order’ model, we had to enter an API endpoint into the fulfillment service. Since we use IP filtering to protect all of our externally visible APIs, we had to enter a dummy API endpoint, since Shopify will not provide an IP address range for API calls.

So the process is now in production and working fine, except we now get error notifications from Shopify as it is failing to send the fulfilment callbacks to the dummy API. I will look to see if I can find some publicly accessible 3rd party system I can dump these API calls.

This is just a waste of resources, and would be much easier if we could just turn off the call back process.

Any help to clean this up would be appreciated.

Thanks,

Martin