External triggers
Issue store credit from Klaviyo, Zapier, Make, or any tool that can send a webhook.
External triggers give your store a private webhook endpoint. Send it a POST request and it credits a customer. That opens up every reward that starts outside Shopify: a review submitted in Klaviyo, a referral confirmed in a partner tool, a goodwill credit issued from your helpdesk.
Open External triggers in the app navigation.
External triggers are a paid feature. On the Free plan, opening External triggers takes you to the Plans page. Your endpoint and secret are kept while you're on Free, and start accepting requests again as soon as you upgrade. See Plans & billing.
Your endpoint
The page gives you two values:
Webhook URL — unique to your store.
Secret — proves the request came from you.
Copy both into the tool that will be sending requests.
Authentication
Send the secret in the X-Stork-Secret header:
X-Stork-Secret: your-secret-hereIf your tool can't set custom headers, pass it as a ?secret= query parameter on the URL instead. The header is preferable — query strings turn up in logs.
Requests with a missing or wrong secret are rejected with 401.
Request body
Send JSON:
email
Yes
The customer to credit. A customer is created if none exists
amount
Yes
The credit amount, e.g. "10.00"
external_id
Yes
A unique ID for this event. Used to de-duplicate retries
currency
No
ISO code. Defaults to your shop's primary currency
reason
No
A note shown in the activity log, e.g. "Review reward"
expires_on
No
A future date. Omit for credit that never expires
De-duplication
external_id is what makes the endpoint safe to call from tools that retry.
Each external_id is credited at most once per store. A repeat request with an ID already seen is acknowledged but issues nothing. Since most tools retry on timeouts and network errors, this is what stands between you and accidental double credits.
Use a value that is genuinely unique per reward event — your source tool's event ID is ideal. A constant, or something that repeats like a customer ID, means only the first request ever credits anyone.
Enabling and disabling
The endpoint has an Enabled/Disabled switch. Disabling makes it reject everything without deleting the URL or secret — useful for pausing an integration you're debugging.
Rotating the secret
Regenerate secret issues a new one immediately.
The old secret stops working the moment you regenerate. Any integration still using it starts failing straight away — update your external tools right after rotating.
Activity log
The page lists the last 20 requests that reached your endpoint: when, which customer, how much, the reason you sent, and whether it credited. This is the first place to check when an integration seems quiet.
Connecting Klaviyo
Klaviyo's no-code webhook action is enough — no custom code.
Zapier, Make, n8n, and anything else that can POST JSON with a custom header follow the same shape.
Notifications
External triggers do not send Shopify's store credit email. The tool sending the webhook is usually the better place to message the customer — it has the context for it.
Troubleshooting
401 responses
Wrong secret, or the secret was rotated and the tool wasn't updated
Requests accepted, nothing credited
A repeated external_id — check the activity log
Nothing in the activity log
Requests aren't arriving; check the URL, or the endpoint is disabled
Customer not found
Not an error — a customer is created automatically
Last updated