HTTP Webhooks being removed, HTTPS will be required.

[Ryan]

Edit: HTTP Webhooks are now completely gone! All webhooks must be HTTPS moving forwards.

Hey all,

In 2018 HTTP is a thing of the past, and over ~95% of you agree.  We are looking to reach 100% HTTPS by 2019.  Therefore we are going to start the deprecation of HTTP webhooks completely.  Here is what the timeline looks like:

On May 1st 2018, newly created apps will no longer be able to create HTTP webhooks.
On July 1st 2018, all apps will no longer be able to create HTTP webhooks.
On January 1st 2019, all remaining HTTP webhooks will be removed.

As always feel free to comment with and questions or concerns.

Regards,

Shopify Apps Team

[Martin_Gingras]

To clearify, is a "new API client" an App created after May 1st or a store that newly authenticates with your application after that date?

[Clayton_Smith]

That means an app created after May 1.

[Ryan]

Clayton is correct, I will edit the original post for clarity.

[John_Stevens]

Will https webhooks require a valid SSL certificate?

[Paul_McWhinnie]

Is there any way that this can be extended to May 7?

We are using private apps.

[Ryan]

Hi Paul,

The change for May 1st only affects new apps created after May 1st.  The change should go out later today, we are not extending the date.

Ryan

[Ryan]

Update: This is now live.

[John_Stevens]

Sorry I asked this a few day ago but never got a reply and there's nothing in the documentation as far as I can tell.

Will https webhooks require a trusted SSL cert that is signed from a trusted CA such as Verisign, Digicert, etc?

[Ryan]

Hi John,

Yes this has been required since February.

Cheers,

Ryan

[Hemal]

Hi Ryan,

Sorry to asking same question as John asked.

Will https webhooks works with Let's Encrypt SSL cert as well? 

[Ryan]

Hemal,

Let's Encrypt should be fine.

Ryan

[Hemal]

Hi Ryan,

Thanks for guiding us.

Hemal

[John_Stevens]

Ryan,

    It would seem that as of around 5PM Eastern yesterday, our http webhooks have stopped functioning. Not sure if http webhooks were disabled by mistake or if something else has gone wrong. Thanks for any input you may have.

Thanks,

John

[Johannes_Hodde]

Hi,

Good step toward 100% ssl support but one thing is still unclear to me (could not find any infos about that).

On January 1st 2019, all remaining HTTP webhooks will be removed.

Does this mean app devs will have to re-create all webhooks (like uninstall hooks) pointing to https? Or do you (shopify) automatically convert previously created http hooks by calling the registered hook via https instead of http?

[Ryan]

The expectation is that app devs will re-create any http webhooks as https.

[Johannes_Hodde]

May I ask why you do not convert those hooks on your end? Just curious

[Ricardo_Amorim]

The expectation is that app devs will re-create any http webhooks as https.

What about shops that are frozen? We can't recreate webhooks for those and they keep sending "shops/update" webhooks to the HTTP endpoint.

[Ryan]

Hi Ricardo,

As of January 1st 2019, we will flush all of those webhooks.  However I will check into the viability of converting them, I'm assuming your use case is watching shop/update to see if they become active again?

Cheers,

Ryan

[Ricardo_Amorim]

Hi Ryan,

That's correct. Would be great if those were converted to HTTPS as we're on track to drop HTTP completely.

Best,

Ricardo