The Shopify webhook reliability pattern: HTTP 200 first, process later

Respond HTTP 200 immediately after HMAC verification, then queue the actual work. This prevents retry storms and duplicate processing.

Why this matters

Shopify times out webhooks at 5 seconds. Multi-store sync, FX computation, or third-party API calls inline will hit that wall on complex products. When retries arrive, you process the same event twice.

Pattern

verify_hmac($payload, $secret)nenqueue($event_id, $payload)nrespond(200)n# Cron worker drains queue separately

5+ years on AAO StarshipIt integration, 150+ daily orders, zero retry storms.