# Setup: Shopify Sales Tracker for "Goosebump Pocket Pari - Ez" ## What this does - Shopify notifies `webhook.php` every time a new order is placed. - `webhook.php` checks the order's line items and saves a row **only** if the product matches `Goosebump Pocket Pari - Ez`. - `dashboard.php` (password protected) shows the person driving traffic how many orders/units/revenue that product has generated — without giving them access to your actual Shopify Admin. - `backfill.php` is optional: run it once from the command line to pull in any past orders for that product (sales that happened before the webhook existed). ## 1. Get Shopify Admin API access (needed for the webhook secret + backfill) As of 2026, Shopify no longer supports creating apps through the old "Develop apps" screen — everything goes through the **Dev Dashboard** (dev.shopify.com), and apps authenticate via OAuth Client ID/Secret instead of an instant token. Here's the actual flow: 1. Go to `dev.shopify.com/dashboard/` (your account needs developer access on the organization — if you see "doesn't have developer access yet", it needs to be granted from **Organization settings**). 2. Click **Apps > Create app**, and under **"Start from Dev Dashboard"** give it a name (e.g. "Sales Tracker") and click **Create**. 3. On the version screen: - **App URL**: your domain, e.g. `https://orders.gblove.in` - Uncheck **Embed app in Shopify admin** (this app has no UI) - Under **API access > Scopes**, click **Select scopes** and add: `read_orders`, `read_products` - Click **Release** to publish this configuration. 4. Go to **Settings** (left sidebar) and note the **Client ID** (visible) and **Secret** (click the eye icon to reveal, then copy it somewhere safe — treat it like a password). 5. Go back to **Overview** and click **Install app**. Pick your store, and on the consent screen click **Install**. This grants the app access — you'll be redirected to your App URL (that's expected, even if nothing is deployed there yet). 6. Now retrieve the actual Admin API access token. Custom apps like this support Shopify's **client credentials grant** — a direct token exchange using your Client ID + Secret, no OAuth redirect dance needed since you already completed the install/consent step. Once you've uploaded these files to your server, SSH/cPanel-Terminal into it and run: ``` php get_token.php ``` It'll prompt for your shop's `*.myshopify.com` domain (not your custom domain — you'll see this in the URL when you're in Shopify Admin, or under Settings > General), Client ID, and Client Secret, and print back the real Admin API access token. Copy that into `SHOPIFY_ADMIN_API_TOKEN` in `config.php`. For the Goosebump store, the `*.myshopify.com` domain observed during setup was `kmpqpv-je.myshopify.com` — double check it under Settings > General in case it's changed. ## 2. Create the webhook 1. In Shopify Admin, go to **Settings > Notifications**, scroll to **Webhooks**, click **Create webhook**. 2. Event: **Order creation**. Format: **JSON**. 3. URL: `https://yourdomain.com/path-to/webhook.php` (the real URL once you've uploaded these files to your Namecheap hosting). 4. After saving, Shopify shows a **signing secret** — copy it into `SHOPIFY_WEBHOOK_SECRET` in `config.php`. This is what `webhook.php` uses to verify requests are genuinely from Shopify. ## 3. Deploy to Namecheap (cPanel) 1. In cPanel, go to **MySQL Databases**, create a new database and a database user, and add that user to the database with **all privileges**. Note the DB name/user/password (cPanel usually prefixes them with your account name). 2. Open **phpMyAdmin**, select the new database, go to **Import**, and upload `db_schema.sql` to create the `sales` table. 3. Upload the whole `ShopifySalesTracker` folder into `public_html` (or a subfolder, e.g. `public_html/sales-tracker`) via File Manager or FTP/SFTP. 4. Copy `config.sample.php` to `config.php` (same folder) and fill in: - the DB credentials from step 1 - `SHOPIFY_WEBHOOK_SECRET` from part 2 - `SHOPIFY_SHOP_DOMAIN` and `SHOPIFY_ADMIN_API_TOKEN` from part 1 - `PRODUCT_TITLE_FILTER` (already set to the right product name — only change if the exact Shopify product title differs) 5. Set a dashboard login for the traffic partner: - `DASHBOARD_USERNAME` — pick any username. - `DASHBOARD_PASSWORD_HASH` — generate with (cPanel Terminal, or your own machine if it has PHP installed): ``` php -r "echo password_hash('yourpassword', PASSWORD_DEFAULT), PHP_EOL;" ``` Paste the output (the whole `$2y$10$...` string) into config.php. 6. Make sure `config.php` is **not** publicly downloadable — the included `.htaccess` already blocks direct requests to it, but double check by visiting `https://yourdomain.com/path-to/config.php` in a browser; it should show a 403, not your secrets. ## 4. Test it 1. Back in Shopify Admin's webhook page, click **Send test notification** next to the webhook you created — check it returns success (Shopify shows delivery status). 2. Place a real (or test) order for the tracked product, then visit `https://yourdomain.com/path-to/dashboard.php`, log in, and confirm it shows up. 3. If you have historical orders for this product from before the webhook existed, run once via SSH or cPanel Terminal: ``` php backfill.php ``` ## 5. Give access to the traffic partner Share only: - The dashboard URL: `https://yourdomain.com/path-to/dashboard.php` - The username/password you set in step 3.5 They never see your Shopify Admin, customer PII, or any product other than the one being tracked. ## Notes / limitations - Only tracks **new** orders from the moment the webhook is live (plus whatever `backfill.php` pulls in separately). - Cancellations/refunds aren't automatically reflected — the `financial_status` column captures the order's status *at the time it was placed*. If you need live status updates, we can add `orders/updated` and `refunds/create` webhooks the same way. - Product matching is by exact (case-insensitive) title. If the product is ever renamed in Shopify, update `PRODUCT_TITLE_FILTER` in `config.php`.