Shopify pilot merchant setup

Pilot app installation

HaulMatch uses a dedicated, non-embedded app with custom distribution for one allowlisted merchant shop. Public distribution requires a separate app registration. GraphQL Admin API is pinned to 2026-10.

The app requests read_orders and merchant-managed fulfillment order read/write scopes. Merchant address access must be approved and available. Missing or redacted Australian addresses block freight publication. Expiring offline credentials are encrypted and refreshed server-side.

• Shopify distribution methods
• Protected customer data
• Open Business apps

Merchant webhooks

After connecting, use the connection-specific webhook path shown in Business apps. Register orders/paid, orders/updated, orders/cancelled, app/uninstalled and app/scopes_update with the app. Configure customers/data_request, customers/redact and shop/redact where required. Raw-body HMAC verification occurs before enqueueing.

Shop and topic headers do not form part of the body signature. HaulMatch rereads each order with the bound merchant credential. Uninstall only disables a connection after the merchant API confirms revoked access. Privacy actions are classified from signed payload fields and require the connected shop identity; changing the topic header cannot expand an erasure. Delayed privacy events remain accepted after disconnect or uninstall. Data requests are recorded in Organization activity in the delivery log for owner follow-up; erasure events remove imported addresses and queued-operation data, stop affected operations and revoke status links. Freight records created in HaulMatch follow their own retention policy.

Review freight drafts

1. New paid Australian physical orders enter review. There is no automatic historical backfill. You can manually import an order within your normal Shopify access window.
2. Supply pickup, packaging, unit count, weight, dimensions, vehicle, delivery date and instructions. Confirm review before publishing through HaulMatch job validation.
3. Order updates invalidate pending approval. Changes to a published order flag the job for manual review; they do not automatically cancel dispatch or move money.

Customer status links

Select an existing successful merchant-managed fulfillment and confirm its tracking reference. HaulMatch updates tracking only; it does not create fulfillments. notifyCustomer stays false.

Links expire after 30 days and can be revoked. Confirming tracking again after expiry or revocation creates a fresh URL; old URLs stay unavailable. They show only Preparing shipment, In transit, Delivered or Cancelled. They contain no job identifier, addresses, GPS, prices, contact details or documents. Status pages disable analytics, caching and indexing. Treat the URL as a private bearer link.

• Tracking update mutation