Webhooks
/[domain]/api/revalidate accepts Shopify webhooks:
- Shopify path verifies
X-Shopify-Hmac-SHA256viavalidateShopifyHmac()(src/utils/webhooks/shopify.ts), maps the topic to per-entity tags (parseShopifyWebhook), and callsrevalidateTag(tag, 'max'). IfSHOPIFY_WEBHOOK_SECRETis unset, validation is skipped with a warning (dev only — never deploy without it).
After invalidating Next.js's data cache, the route handler also calls
evictApolloClient({ shopId: shop.id }) from src/api/_apollo-pool.ts to
drop the matching per-tenant Apollo InMemoryCache entries. Both branches
of the handler (broad sweep and entity-tagged) perform this step — without
it, the in-memory Apollo cache would diverge from Next.js's data cache.
See Per-tenant Apollo client cache
and Cache tags for the tag scheme.
CMS invalidation arrives from Convex: publishing in the editor runs the deployment's
revalidation pipeline (packages/convex/convex/revalidate/), which delivers signed
events to /api/revalidate/convex; the route verifies the CONVEX_REVALIDATE_SECRET
HMAC, then calls revalidateTag for the matching cms tags.