Welcome new Shopify customers by text

Priya runs Fern & Folly, a plant shop on Shopify. Customers who tick “Text me with news and offers” at checkout get nothing personal from her, only Shopify’s order emails. She wants each of them to get a short welcome from her own number a couple of hours after their first order: who she is, how to reach her, and that a care card for their plant is in the box.

What you’ll have

• A welcome text from your number to each new customer who agreed to texts at checkout, two hours after their first order.
• Customers who didn’t agree left alone, and never texted twice.
• Their reply in BlueBot’s inbox and on your iPhone.

What you need

• A BlueBot account with your Mac connected.
• A Shopify store where you can change settings.
• Checkout set to collect a phone number and offer SMS sign-up. In Shopify’s admin, open Settings, then Checkout, and under Marketing options turn on SMS. Customers then see a box to tick for texts, and Shopify records what they chose on the customer as sms_marketing_consent.

With Zapier

Shopify customers are made at checkout, so the trigger fires as the first order is placed. A customer who later buys again isn’t new and gets nothing.

With your own handler

Use this when you want to choose what the welcome says from the order, or record it in your own systems. Shopify posts each new customer to your handler; the handler checks Shopify’s signature and the consent, then schedules the text two hours out with send_at.

export BLUEBOT_API_KEY="bb_live_…"
export SHOPIFY_WEBHOOK_SECRET="the secret Shopify shows"

// app/hooks/shopify/route.ts (Next.js). Any framework works: read the raw body first.
import { createHmac, timingSafeEqual } from 'node:crypto';
import BlueBot from '@usebluebot/sdk';

const client = new BlueBot({ apiKey: process.env.BLUEBOT_API_KEY });

function signedByShopify(payload: string, header: string | null): boolean {
  if (!header) return false;
  const expected = createHmac('sha256', process.env.SHOPIFY_WEBHOOK_SECRET!).update(payload).digest('base64');
  return header.length === expected.length && timingSafeEqual(Buffer.from(header), Buffer.from(expected));
}

export async function POST(request: Request) {
  const payload = await request.text();
  if (!signedByShopify(payload, request.headers.get('x-shopify-hmac-sha256'))) {
    return new Response('Bad signature', { status: 401 });
  }

  const customer = JSON.parse(payload);
  const agreed = customer.sms_marketing_consent?.state === 'subscribed';
  if (!agreed || !customer.phone) return new Response(null, { status: 200 });

  const twoHoursFromNow = new Date(Date.now() + 2 * 60 * 60 * 1000).toISOString();
  await client.messages.send(
    {
      to: customer.phone,
      text: `Hi ${customer.first_name ?? 'there'}, it’s Priya from Fern & Folly. Thanks for your first order. There’s a care card in the box, and you can text me here any time your plant looks unhappy.`,
      sendAt: twoHoursFromNow,
      metadata: { source: 'shopify', customer_id: String(customer.id) },
    },
    { idempotencyKey: `shopify-welcome-${customer.id}` },
  );
  return new Response(null, { status: 200 });
}

curl -X POST "https://usebluebot.com/api/v1/messages" \
  -H "Authorization: Bearer $BLUEBOT_API_KEY" \
  -H "Content-Type: application/json" \
  -H "Idempotency-Key: shopify-welcome-7290918453304" \
  -d '{
    "to": "+15555550123",
    "text": "Hi Maria, it’s Priya from Fern & Folly. Thanks for your first order. There’s a care card in the box, and you can text me here any time your plant looks unhappy.",
    "send_at": "2026-11-13T21:41:00.000Z",
    "metadata": {
      "source": "shopify",
      "customer_id": "7290918453304"
    }
  }'

Test it

Place a test order in your own store as a new customer, with your own mobile number, and tick the box for texts. Use a discount code or a test payment gateway so nothing is charged. To see it sooner, set the delay to two minutes while you test, then put it back.

When it goes wrong

• A customer gave their number only for shipping. Shopify keeps a shipping phone on the address and a contact phone on the customer. The handler reads the customer’s phone, which is the one consent applies to. Leave shipping numbers alone.
• Your Mac was off when the text was due. The welcome waits for your Mac and goes when it’s back, unless it’s still waiting 24 hours after its time, when it expires. A welcome two days late is worse than none, so that default suits it.
• A busy sale weekend. More than 50 first-time customers in a day goes past your daily limit for new people, and the rest wait until tomorrow with hold.reason: "daily_new_people_limit". Raise it in Settings, then Sending rules, only as far as you’re sure those people want the text.
• A customer replies STOP. They go on your stop list, and BlueBot cancels every text to them from then on, scheduled ones included. Shopify isn’t told; if you also send texts from Shopify, unsubscribe them there too.

Next