Claimful docs
Shopify plugin
Shopify surface matrix: theme embed, checkout extension, and order-webhook confirm.
Pick the surface that matches the page
Shopify has three separate places the protection offer can appear, and they do not share one mechanism. The universal widget script cannot run inside Shopify checkout: since 2024, Shopify checkout enforces a strict CSP sandbox that blocks arbitrary third-party scripts, so the <claimful-widget> script embed only works on online-store pages. Use the Checkout UI Extension for the checkout page, and confirm protection server-side from the order webhook.
| Surface | Renders on | How the offer shows | Confirm mechanism | Use it for |
|---|---|---|---|---|
| Legacy theme embed | Online store pages (product, cart) | <claimful-widget> script | Buyer confirm in the widget with the publishable wk_ key | Storefront pages only — blocked in checkout |
| Checkout UI Extension | Checkout page | Native Shopify block (this app), quote fetched with the wk_ key | Records buyer opt-in as a checkout attribute; no browser confirm | Showing the offer at checkout |
| Order-webhook server confirm | Your server (Shopify orders/create) | No buyer UI — server-side | Headless quote + confirm with the secret mch_ key, keyed by quoteId | The reliable, money-affecting confirm (also the headless fallback) |
Why confirm runs on the server
A Checkout UI Extension cannot reliably run code at the moment an order is placed, and per ADR 0038 the quoteToken is never persisted or exposed to merchant code. The extension therefore only records the opt-in; the dependable confirm happens in your orders/create webhook, which re-quotes from the final order and confirms with the secret mch_ key. This same server path is the fallback for headless and custom-cart stores that have no Shopify checkout surface at all.
Boundaries
The app wraps @claimful/sdk and does not build its own retry loop, API auth, idempotency key handling, or webhook verifier. The publishable wk_key is the only key type that may reach a buyer’s browser; the secret mch_ key stays server-side.