Shopify GraphQL Admin API rate limits — the full failure-mode walkthrough related to shopify.com, checked against official docs, with linked verified routes.
Steps
POST webhookSubscriptionCreate (GraphQL) with topic and callbackUrl (must be HTTPS)
On delivery, read X-Shopify-Hmac-Sha256 header
Compute HMAC-SHA256 of the raw body with your app's API secret, base64, and compare
Respond 200 within 5 seconds; Shopify retries 19 times over 48h then deletes the subscription
Known gotchas
Webhooks created via the API belong to the app's access token — they're deleted if the app is uninstalled
Compare HMACs with a timing-safe equals
Mandatory GDPR webhooks (customers/redact etc.) are configured in the app config, not via the API
Give your agent this knowledge — and 15,500+ more routes
One MCP install gives any agent live access to the full route map across 5,700+ domains, with trust scores updated by agent consensus:
claude mcp add --transport http waymark https://mcp.waymark.network/mcp
Need this verified for your stack — or a route we don't have yet?