Shopify Flow Guide

Shopify Flow is Shopify's built-in automation platform. B2B Onboard integrates with Flow to let you automate registration workflows without writing any code.

Triggers fire events when things happen in B2B Onboard — a new application is submitted, an application is approved, rejected, or more information is requested. Actions let Flow workflows take actions inside B2B Onboard — approving or rejecting an application, tagging a customer, or adding an internal note to an application.

You can combine B2B Onboard triggers and actions with hundreds of other Shopify Flow connectors to build powerful automations.

Every trigger fires on every plan, so you can build workflows on any plan. On Free and Starter the Growth+ fields are present but empty. Actions that execute back into B2B Onboard, and certificate download links, need Growth or Pro.

Triggers fire events when something happens in B2B Onboard. Use them to start Flow workflows. Every trigger fires on every plan; the richer fields are filled on Growth and Pro. The Payload reference lists every field.

Triggers are fire-and-forget. If Flow is unavailable, the app's normal operation is not affected.

Actions let Flow workflows take actions inside B2B Onboard. Available on Growth and Pro plans. For Application ID, use Add variable and pick applicationId from the trigger step.

Actions executed via Flow show "Shopify Flow" as the actor in the application timeline.

Running the Reject action on an application that is already rejected does nothing and does not fire Registration Rejected again, so a workflow on that trigger can't loop on it.

The Add internal note action (add-internal-note) writes whatever your workflow produces — the result of an HTTP request, a Run code step, or a fixed text — onto the application, where your reviewers look.

• Notes appear on the application page under From Shopify Flow, marked "via Shopify Flow" plus the author label, and never replace the staff note.
• Note key (optional): give a note a key, for example background_check, and a new note with the same key replaces the previous one on the application page, which then shows only the latest version with "Latest version · replaces N earlier". Earlier versions are kept: every note stays in the application timeline and still counts toward the 200-note limit. Keys use letters, numbers, "_" and "-" (up to 64 characters) and are not case-sensitive. Without a key, every note is shown.
• Notes are plain text only: line breaks are kept, links are shown as text and are not clickable.
• A note can hold up to 10,000 characters. Longer notes are shortened, marked "Shortened", and truncated is true.
• An application can hold at most 200 notes from Flow. Notes can't be added to quarantined, sample or GDPR-erased applications.
• The step returns noteId (ID of the new note), appendedAt (when it was added, ISO 8601 UTC), truncated (true when it was shortened) characterCount (characters stored) and replacedNoteId (ID of the earlier note with the same Note key that this note replaces, or empty when there is none), which later steps in the workflow can use. In the Flow editor they are under the Add internal note step, for example {{addInternalNote.noteId}}.
• If Flow retries or re-runs the same step, the note is not added a second time.

B2B Onboard never decides anything from a note: notes never approve or reject an application. Use the Approve or Reject actions for that.

Copy Flow notes to the company (Growth and Pro, off by default): in Settings → Automations, choose a Note key (for example background_check) and a company metafield namespace and key (for example custom.background_check). When the application is approved, the latest note with that key is written to the Shopify company as a multi-line text metafield, for a new company and for an existing company the application was matched to. After approval, each newer note with the same key updates the metafield, so apps and the Admin API always read the latest version. If your store already has a metafield definition with that namespace and key, it must be of type multi-line text, or Shopify rejects the write; the approval itself still succeeds.

Every field each trigger sends, one table per trigger. The four registration triggers (Submitted, Approved, Rejected, Information Requested) share one table of registration fields, followed by the fields only some of them carry. The other triggers each have their own table.

• Field is the name shown in the Flow editor. Flow variable is what you type in Liquid: the field name in camelCase, for example Tax ID Source is {{taxIdSource}}.
• Plan: All fields are filled on every plan. Growth+ fields are always present, but empty (or 0 / false) on Free and Starter and filled on Growth and Pro.
• Flow references (customer on Registration Approved, company on Credit Updated) are Shopify objects, not text: later steps can read their data directly, for example {{customer.email}}.
• Lists (answers.items, certificates.items) are described in List fields. Flow doesn’t output a whole list or object: loop over the items and use their fields.

{% for c in certificates.items %}{{c.fileName}} {{c.status}}{% endfor %}

To put a text value into JSON (for example in a Send HTTP request body), add | json to that one field: {{c.fileName | json}} outputs it quoted and escaped.

All four registration triggers (Registration Submitted, Registration Approved, Registration Rejected and Information Requested) carry the fields below, so you can branch a workflow on what the applicant answered or send the application to your own systems. The fields only some of them carry are in Approved-only fields and Submitted-, Rejected- and Information Requested-only fields.

answers.items is on all four registration triggers. certificates.items is on Registration Submitted (without download links) and Registration Approved (with downloadUrl and linkExpiresAt when certificate download links are on); it lists at most 20 certificates, newest first, and certificateCount has the total. Both lists are empty on Free and Starter. The variables below assume a loop such as {% for a in answers.items %}.

Answer items (answers.items)

Certificate items (certificates.items)

To use one specific answer, loop over the answers and match on its key:

{% for a in answers.items %}{% if a.key == "company_size" %}{{ a.value }}{% endif %}{% endfor %}

The key is built from the question label, exactly like the answer variables in your email templates (company_size in Flow is {{fields.company_size}} in an email). Two questions with the same label get _2, _3 and so on. If you edit a question’s label, its key changes, so update any workflow that matches on the old key.

Registration Approved carries the registration fields plus the fields below, which say what the approval did in Shopify. The customer reference, the customer and company IDs and autoApproved / reviewedBy are sent on every plan. The company is sent as IDs rather than a Flow reference because an approval can have no company; to load the company in a workflow, use Flow’s “Get company data” action with the Shopify Company ID.

Reviewer-set metafields are sent as keys only: the values are already on the customer or company in Shopify, so read them there: customer metafields through the customer reference, and company metafields by loading the company with Flow’s Get company data action and the Shopify Company ID.

Besides the registration fields, each of these triggers carries the fields marked with its name.

A rejected application is no longer waiting for review, so the rejected applicant can apply again under every policy. reapplicationPolicy only tells you whether the form blocks a duplicate while an earlier application is still waiting: never blocks it, after_30_days blocks it until 30 days after the waiting application was submitted, and always never blocks.

The Registration Quarantined trigger deliberately carries no applicant data on any plan: no company or contact name, no email and no answers. A quarantined submission is suspected spam, so its content could be spam text or phishing links, and forwarding it to Slack, email or another system would pass that on. You get IDs, timing, the names of the checks that flagged it and a link to review it in the app. It carries no customer or company reference. To stop a spam burst flooding your workflows, it fires at most 20 times per hour per store; further quarantined submissions in that hour are still held and listed on the Quarantine tab (Applications).

The Registration Restored trigger fires once when you mark a quarantined submission as not spam. The application then continues like a fresh submission, so Registration Submitted fires too. It carries no customer or company reference: none exists yet. If the application is approved, Registration Approved carries them.

The Registration Released trigger fires once per application held by your monthly plan limit when it is released for review (after an upgrade or at the start of a new month). Registration Submitted fires for it at the same time. It carries no customer or company reference.

The Certificate Updated trigger has its own fields; the registration fields are not part of it. It carries no customer or company reference, because many certificate events happen before approval, when there is no customer yet: use the two ID fields instead.

certificateEvent is one of these values. Add a condition such as certificateEvent == "needs_review" to react to one kind of change:

verified, flagged and needs_review come from AI verification, which runs on Growth and Pro. expiring_soon and refresh_due fire on every plan, once per certificate, at the same 30-day, 7-day and refresh-cadence points where Pro shops get the reminder email. expired fires once when the certificate lapses.

The Tax Exemption Updated trigger fires only after approval, when a buyer’s tax exemption is applied or removed in Shopify. Tax decisions made at approval (applied, withheld, skipped or failed, including automatic approval, the Flow approve action and CSV import) are on the Registration Approved trigger’s tax exemption fields, not this one, so an approval is never reported twice. Changes that write nothing to Shopify (skipped or failed) stay in the application’s timeline. The registration fields are not part of this trigger.

taxExemptionSource is one of these values. Add a condition such as taxExemptionEvent == "revoked" to react to removals only:

When a certificate lapses, the Certificate Updated trigger fires with expired for the certificate, and this trigger fires with revoked when an exemption was actually removed from the buyer.

The Credit Updated trigger fires when a company’s trade credit changes: a buyer applies (submitted), you approve or decline the application (approved / declined; editing an approved decision fires approved again), you revoke credit (revoked), or a guarantor signs a personal guarantee (guarantee_signed). Filter on Credit Event to react to one of them. The trigger carries statuses, limits and IDs only: no guarantor or trade-reference data is ever sent; open the company in the app to see it. It also carries the Shopify company as a Flow reference.

The Agreement Signed trigger fires each time a buyer accepts your trade agreement: on the registration form before approval, or from a re-sign link after approval. When an agreement signed before approval is carried over to the new company at approval, it does not fire again. No signature image, signed PDF, IP address or browser details are ever sent.

B2B Onboard ships with pre-built Flow templates — complete workflows with variables already wired up. Install one with a single click and customise it to fit your needs.

To install a template: go to Settings → Flow → Browse templates and search for "B2B Onboard". Templates can be fully customised after installation — add conditions, change actions, or combine with other connectors.

Sending certificates to an ERP

Flow can’t transfer files, so the Send tax certificates to your ERP template sends certificate download links instead, and your own endpoint fetches the files. B2B Onboard has no direct ERP connector.

1. Turn on links: in B2B Onboard, open Settings → Automations and tick Include certificate download links in the Approved trigger (Growth and Pro).
2. Install the template: Settings → Flow → Browse templates, search “B2B Onboard”. It checks certificateLinksEnabled is true and certificateCount is greater than 0 before sending anything.
3. Point it at your middleware: in the Send HTTP request step, enter the URL of your own endpoint (for example a Make, n8n or Zapier webhook, or your ERP’s API) and add any authentication header it needs. The URL is left empty on purpose, so Flow highlights it. Send HTTP request is available only on Shopify plans that include it.
4. Download before expiry: your endpoint receives a JSON body like the one below and must download each downloadUrl before linkExpiresAt (24 hours by default).
5. Check the note: the application gets a note such as “Sent 1 certificate link(s) to your ERP endpoint. HTTP status: 200”, labelled “via Shopify Flow · ERP handoff”. Each download also shows on the application’s timeline.

The template’s request body loops over the certificates (Flow doesn’t output a whole list) and leaves out the company name, email and tax ID; add fields if your ERP needs them:

{
  "applicationId": "{{applicationId}}",
  "shopifyCompanyId": "{{shopifyCompanyId}}",
  "shopifyCustomerId": "{{shopifyCustomerId}}",
  "certificates": [{% for c in certificates.items %}
    {
      "certificateId": "{{c.certificateId}}",
      "fileName": {{c.fileName | json}},
      "contentType": "{{c.contentType}}",
      "status": "{{c.status}}",
      "decision": "{{c.decision}}",
      "certificateExpiresAt": "{{c.certificateExpiresAt}}",
      "downloadUrl": "{{c.downloadUrl}}",
      "linkExpiresAt": "{{c.linkExpiresAt}}"
    }{% unless forloop.last %},{% endunless %}{% endfor %}
  ]
}

Here are a few common automations you can build with B2B Onboard and Shopify Flow:

• Auto-tag approved customers: Registration Approved trigger → Tag B2B Customer action (tags: "b2b", "wholesale")
• Slack notification on new submission: Registration Submitted trigger → Shopify's built-in "Send Slack message" action
• Auto-approve VIP companies: Registration Submitted trigger → Condition (Company Name is one of your VIP company names, e.g. "Acme Corp") → Approve Registration action
• Auto-reject free email domains: Registration Submitted trigger → Condition (email contains gmail.com or yahoo.com) → Reject Registration action
• CRM sync: Registration Approved trigger → Send data to your CRM via HTTP webhook action
• Send certificates to your ERP: Registration Approved trigger → Condition (certificateLinksEnabled is true) → Send HTTP request to your own middleware → Add internal note (see Sending certificates to an ERP)
• Follow-up reminder: Registration Submitted trigger → Wait 48 hours → Condition (status is still pending) → Send email reminder to merchant

Build workflows in the Shopify Flow editor: go to Settings → Flow in your Shopify admin.

On every plan, Flow trigger payloads include application metadata: IDs, company name, contact name, form, timestamps, and status-related fields such as the reviewer and a rejection reason.

On the Growth and Pro plans, payloads also carry the applicant’s contact email, tax ID and its check result, the delivery country, and every answer on the form, including addresses and phone numbers (see Trigger Fields). On Free and Starter, nothing beyond the metadata is sent.

Uploaded files are never sent: file questions carry only the file names. On Growth and Pro, when you turn on certificate download links (Settings → Automations), the Approved trigger carries a time-limited link per tax certificate, and anyone with the link can download that file until it expires.

The Registration Quarantined trigger shares no applicant data on any plan: only IDs, timestamps, the names of the spam checks that flagged the submission and a link to review it in the app. Restored and Released follow the same rules as the other registration triggers.

The Certificate Updated trigger shares a certificate’s status, expiry date and covered states on every plan. No document, file or content read from the certificate is ever sent to Flow.

The Tax Exemption Updated trigger shares the exemption basis, where it is set, and the Shopify exemption codes applied, removed and remaining on every plan. It never sends a tax ID or certificate content.

The Credit Updated trigger shares a company’s credit limits, payment terms and credit and guarantee statuses on every plan. The Agreement Signed trigger shares the agreement version and signing facts (when, how, and whether it was before approval). Guarantor and trade-reference details, signatures and documents are never shared.

You decide where your workflows send this data. If a workflow forwards it to another app or system (an email, a spreadsheet, an HTTP request), that destination receives the applicant’s answers, so only connect services you trust with them.

Data is processed by Shopify under their existing privacy terms. For details, see our Privacy Policy.

Flow can’t move files itself, so B2B Onboard can put a time-limited download link for each tax exemption certificate into the Approved trigger. Your own system (an ERP, or middleware such as Make, n8n or Zapier) receives the links from Flow and downloads the files. Available on Growth and Pro.

Turn it on: go to Settings → Automations, tick Include certificate download links in the Approved trigger in the Works with Shopify Flow card, choose the link lifetime and save. It is off until you turn it on.

• Lifetime: 1 to 168 hours (default 24, which matches the 24 hours Flow keeps retrying a failed HTTP step). Each link can be used any number of times until it expires. A manual re-run of an old Flow run reuses the OLD link, which may have expired by then.
• What revokes links: turning the setting off (links stay dead even if you turn it on again), Revoke all links now on the same card, uninstalling the app, a downgrade below Growth, and GDPR erasure of the customer’s data or of your store’s data.
• Who can see them: links appear in Shopify Flow’s run history for 14 days, where staff with Flow access can see them. Anyone who has a link can download the file until it expires, so only send links to systems you trust.
• Logging: every download is logged, and shown on the application’s timeline as “Certificate downloaded through a Shopify Flow link”.
• Large files: files over 4 MB are served through a short redirect to secure storage; tools that follow redirects (the default in Make, n8n, Zapier and curl -L) handle this automatically.

Sending the links to your system: in a workflow that starts with the Approved trigger, add a condition on certificateLinksEnabled, then a Send HTTP request action pointed at your own middleware or your ERP’s endpoint, with a body that loops over certificates.items (Flow doesn’t output a whole list or object, so loop with {% for c in certificates.items %}…{% endfor %} as in the ready-made ERP template). Your system then downloads each downloadUrl before linkExpiresAt. The Submitted trigger lists the same certificates without links.

To create your first workflow:

1. Open your Shopify admin
2. Go to Settings → Flow
3. Click Create workflow
4. Select a B2B Onboard trigger to start the workflow
5. Add conditions and actions as needed
6. Click Turn on workflow to activate

For more on Shopify Flow, see the Shopify Flow documentation.

The easiest way to test a workflow is to submit a test application through your own registration form:

1. Visit your registration form URL on the storefront
2. Submit an application using a test email address (e.g., test@yourstore.com) so you can identify and delete it later
3. In your Shopify admin, go to Settings → Flow and click on your workflow
4. Open the Run history tab to see whether the workflow triggered correctly and review each step's result

If a step failed, the run history shows the error details. Common issues include missing conditions or incorrect action configuration. You can edit the workflow and re-test by submitting another application.