Shopify → Supabase → Twilio

Architecture

1. 01shopifyorders/create and orders/updated webhooks
2. 02supabasenormalize order + customer phone
3. 03twiliosms only after status crosses your threshold

Env-var matrix

Security checklist

• verify shopify hmac on every webhookorder injection is a fraud vector
• normalize phone to e.164 before twiliosilent failures look like 'sms never sent'
• rate-limit sms per order idorders/updated can fan out dozens of events

Folders

· src/webhooks/shopify.ts
· src/sms/order-status.ts
· src/lib/hmac.ts