Shopify

Abandoned cart reminders, order confirmations, shipping updates with the tracking link, and OTP codes — sent from your templates, at your plan prices. Links become tracked short links on your short domain.

Connect

Portal › Integrations › Shopify: enter your-store.myshopify.com and click Connect.
Shopify asks you to approve read access to checkouts, orders, customers and fulfillments. You come back to the portal connected.
Choose the sender ID, enable the events you want and edit the texts. Start in test mode to see the SMS in your message log without sending.

Security: the OAuth state is single use, valid 10 minutes and bound to your login; Shopify's hmac is checked on every callback; the access token is stored encrypted. Every webhook is checked against X-Shopify-Hmac-Sha256 (HMAC-SHA256 of the raw body with the app secret) and the shop domain; repeated deliveries are ignored. Uninstalling the app in Shopify disconnects it here.

Events and templates

Event	Shopify webhook	When the SMS goes out
Abandoned cart	`checkouts/create`, `checkouts/update`	N minutes (default 60, 15–2880) after the checkout started, if no order was placed for it. Link: Shopify's recovery URL.
Order created	`orders/create`	Right away (also closes the checkout: no reminder)
Order shipped	`fulfillments/create`	Right away, with the carrier's tracking link

Variables: {first_name} {store} {order_number} {total} {currency} {cart_url} {tracking_url} {tracking_number} {carrier}. One SMS per event and order, never two. Every event (sent, skipped, failed) is in the connection's log.

OTP codes (login / checkout confirmation)

Enable OTP code and add an app proxy (subpath apps/sms → https://app.ogave.co/integrations/shopify/proxy). Your theme then calls, from the storefront:

fetch('/apps/sms/otp/start', {method: 'POST', headers: {'Content-Type': 'application/json'}, body: JSON.stringify({phone: '+573001234567'})})
// → {"verification_id": "ver_…", "status": "pending", "expires_at": "…"}
fetch('/apps/sms/otp/check', {method: 'POST', headers: {'Content-Type': 'application/json'}, body: JSON.stringify({verification_id: 'ver_…', code: '123456'})})
// → {"result": "approved" | "invalid" | "expired" | "max_attempts"}

Shopify signs proxy requests (signature); we refuse unsigned ones. Codes are sent by Verify (one Verify app per store: same code rules, fraud limits, prices and logs).

Platform setup (admins)

Create a public app in the Shopify Partner dashboard. App URL https://app.ogave.co/integrations/shopify/install, redirect URL https://app.ogave.co/integrations/shopify/callback. Paste the client ID and secret in Admin › Settings › Integrations.