Advanced

Integrations and webhooks

Connect Sofcy to your own tools: start Shopify Flow workflows from new reviews, read and manage reviews through an API, or receive review events at your own URL.

Settings › Integrations shows what is connected: the Shopify product catalog, Sofcy's email delivery, the private reviews API and signed review webhooks.

Shopify Flow

Sofcy adds a Flow trigger called Review collected. It starts a workflow whenever a new product review comes in, so you can, for example, tag a customer or post to a team chat when a low rating arrives.

In the Shopify Flow app, create a workflow and choose Review collected as the trigger. It provides the product, Rating, Review title, Review status, Review source, Review ID and Verified review. Store reviews do not trigger it.

Private reviews API

For developers. Create a token in Settings › Advanced, under API tokens (or View API tokens on the Integrations page).

  1. Enter a Token name.
  2. Choose its scopes: Read published reviews, Read all review states, Moderate reviews, Create and edit reviews, Permanently delete reviews. Give only what the tool needs.
  3. Click Create token, and copy the token straight away. It starts with sofcy_live_ and is shown only once.

The token list shows when each was last used. Revoke stops a token at once.

RequestDoes
GET /api/reviews?status=published&limit=50List reviews, up to 100 per page, with after for the next page. status=all needs the read-all scope.
POST /api/reviews with {"reviewId", "status"}Set a status: published, hidden, archived or spam.
POST /api/reviews with {"operation": "create", …}Create a review. It arrives pending.
PATCH / DELETE /api/reviewsEdit or permanently delete a review.

Requests go to https://app.sofcyreviews.com with the token as a bearer token. Every write needs an Idempotency-Key header of 8 to 128 characters, and bodies are limited to 16 KB.

Signed review webhooks

Sofcy can send review events to your own HTTPS endpoint. Set it up in Settings › Advanced, under Developer webhooks.

  1. Tick Send signed review webhooks and enter your Webhook HTTPS URL. It must be a public https:// address on port 443.
  2. Under Events to send, keep or untick Review submitted, Review published and Review updated.
  3. Save, and copy the signing secret from the banner. It starts with sofcy_whsec_ and is shown once. To get a new one later, tick Rotate signing secret on save.

Checking the signature

Each request carries X-Sofcy-Event, X-Sofcy-Event-Id, X-Sofcy-Timestamp (Unix seconds) and X-Sofcy-Signature. The signature is sha256= followed by the hex HMAC-SHA256 of {timestamp}.{body}, using your secret. Reject requests whose signature does not match or whose timestamp is old.

Delivery