How Shopify brands answer 'where is my order?' over iMessage

Who uses iMessage for order-status support?

iMessage order-status support suits Shopify and DTC brands, such as beauty, apparel and home-goods stores, whose customers mostly use iPhones. ZeroSettle is an iMessage API: a real phone number on real iMessage, running on Apple hardware we operate for you, that your code texts customers from and hears back on through a bearer token and signed webhooks.

“Where is my order?” (WISMO) questions are lookups: the carrier, tracking link and estimated delivery already sit on the order’s fulfillment in Shopify, so a handler can answer most of them without a person. A chat widget is gone when the tab closes; an iMessage thread stays in Messages, so the follow-up (“it says delivered but it’s not here”) lands under the first answer. Pre-sale product questions are a different job (text-to-buy over iMessage), and more are in 50 ways businesses use iMessage.

How iMessage order-status support works, step by step

The customer starts the thread, ZeroSettle delivers the text to your webhook, and your handler answers from Shopify.

1. Put a “Text us” link on the order status page and in shipping emails: an sms: link to your number with the body prefilled as “Order #20431”.
2. ZeroSettle POSTs a signed message.received event to your webhook about 1–2 seconds after the line receives the text (how iMessage webhooks are signed and retried).
3. The handler parses the order number, calls POST /api/imessage/typing so the customer sees the “…” bubble, and looks the order up in the Shopify Admin API.
4. If the order’s phone matches the sender, the handler replies with POST /api/imessage/send: carrier, estimated delivery and tracking link. The send clears the bubble.
5. A damage photo arrives with the file (kind: "image", a camera photo as a JPEG) and goes to a person who approves the replacement (photos, voice and tapbacks over the API).
6. Anything else goes to a person too: your team answers in the ZeroSettle console, or your handler relays it to Slack or a help desk.

Example conversation: order-status support

A customer texts an order number, sees the store typing, and gets the delay and a new ETA in one reply; the damage photo goes to a person. The greeting and the weather detail need a fuller handler that also reads the carrier’s tracking data; the code below answers from Shopify alone.

Setup: an order-lookup handler with a typing bubble

The setup is a prefilled link in Shopify’s notifications and one webhook handler, following the customer support section of the ZeroSettle docs.

<a href="sms:+18055550100&body=Order%20{{ order_name | url_encode }}">Text us about this order</a>

Shopify’s order_name is usually a pound sign plus the order number (#20431). url_encode turns the # into %23; a raw # starts a URL fragment and can cut the order number off. The filter writes spaces as +, so the space stays outside it as %20.

# wismo.py: run with  uvicorn wismo:app --port 8100
import asyncio, hashlib, hmac, json, os, re, time
import httpx
from fastapi import BackgroundTasks, FastAPI, Request, Response

app = FastAPI()
ZS = "https://portal.zerosettle.io"
TOKEN, SECRET = os.environ["ZEROSETTLE_TOKEN"], os.environ["ZEROSETTLE_WEBHOOK_SECRET"]
SHOP = f"https://{os.environ['SHOPIFY_STORE']}.myshopify.com/admin/api/2026-10/graphql.json"
QUERY = """query ($q: String!) { orders(first: 1, query: $q) { edges { node {
  name phone cancelledAt shippingAddress { phone }
  fulfillments(first: 5) { estimatedDeliveryAt trackingInfo(first: 1) { company number url } } } } } }"""
lock, seen = asyncio.Lock(), set()     # a line sends one message at a time; keep seen in your DB

def verify(secret: str, header: str, raw_body: bytes, tolerance: int = 300) -> bool:
    try:
        parts = dict(p.split("=", 1) for p in header.split(","))
        t, v1 = int(parts["t"]), parts["v1"]
    except Exception:
        return False
    if abs(time.time() - t) > tolerance:
        return False
    expected = hmac.new(secret.encode(), f"{t}.".encode() + raw_body, hashlib.sha256).hexdigest()
    return hmac.compare_digest(expected, v1)

async def zs(path, body):              # True when ZeroSettle answered 200
    try:
        async with lock, httpx.AsyncClient() as c:
            r = await c.post(ZS + path, headers={"Authorization": f"Bearer {TOKEN}"}, json=body, timeout=90)
        return r.status_code == 200
    except httpx.HTTPError:
        return False

async def find_order(name):
    async with httpx.AsyncClient() as c:
        r = await c.post(SHOP, headers={"X-Shopify-Access-Token": os.environ["SHOPIFY_ADMIN_TOKEN"]},
                         json={"query": QUERY, "variables": {"q": f"name:{name}"}}, timeout=20)
    edges = ((r.json().get("data") or {}).get("orders") or {}).get("edges", [])
    return edges[0]["node"] if edges and edges[0]["node"]["name"] == name else None

def owns(o, handle):   # the order's phone or shipping phone is the sender's number
    last10 = lambda s: re.sub(r"\D", "", s or "")[-10:]
    mine = "" if "@" in handle else last10(handle)
    return len(mine) == 10 and mine in (last10(o["phone"]), last10((o["shippingAddress"] or {}).get("phone")))

def answer(o):
    if o["cancelledAt"]:
        return f"Order {o['name']} was cancelled."
    f = next((f for f in o["fulfillments"] if f["trackingInfo"]), None)
    if f is None:
        return f"Order {o['name']} doesn't have tracking yet."
    t, eta = f["trackingInfo"][0], f["estimatedDeliveryAt"]
    return (f"Order {o['name']} shipped with {t['company'] or 'the carrier'}."
            + (f" ETA {eta[:10]}." if eta else "") + f" Track it: {t['url'] or t['number']}")

def to_team(m):   # your help desk here; m["image"]["url"] is fetched with the same bearer
    print("for a person:", m["handle"], m.get("text"), m.get("image"))

async def handle(m):
    hit = re.search(r"#\s*(\d{3,})", m.get("text") or "")
    if m.get("kind") == "image" or not hit:
        return to_team(m)                  # photos and other questions go to a person
    name = "#" + hit.group(1)
    if not lock.locked():                  # skip the bubble while a burst is queued
        await zs("/api/imessage/typing", {"to": m["handle"], "state": "start", "ttl_s": 20})
    try:
        order = await find_order(name)
    except (httpx.HTTPError, ValueError):
        order = None
    ok = order is not None and owns(order, m["handle"])
    text = answer(order) if ok else f"I couldn't find {name} for this number. Someone from our team will reply here."
    if not await zs("/api/imessage/send", {"to": m["handle"], "text": text}) or not ok:
        to_team(m)                         # no match, or the send was refused (say, after STOP)

@app.post("/webhook")
async def webhook(req: Request, tasks: BackgroundTasks):
    raw = await req.body()
    if not verify(SECRET, req.headers.get("X-ZeroSettle-Signature", ""), raw):
        return Response(status_code=401)
    ev = json.loads(raw); m = ev.get("message")
    if m is None or ev["event"] != "message.received" or (m["id"], ev["event"]) in seen:
        return {"ok": True}                # react only to new inbound; retries repeat id and event
    seen.add((m["id"], ev["event"]))
    tasks.add_task(handle, m)              # answer 2xx now, work afterwards
    return {"ok": True}

The ownership check stops someone who texts a neighboring order number from reading a stranger’s tracking; an order with no phone on it, or a text from an iMessage email address, goes to a person. The Shopify token needs read_orders, and the Admin API returns only the last 60 days of orders without read_all_orders, so older order numbers go to a person too. Register the handler with PUT /api/imessage/webhook and store the signing secret, which is shown once (webhook steps in the docs).

Limits and consent for order-status support

Order-status support is customer-initiated, so ZeroSettle’s new-contact limits never apply to it. Throughput does: a line sends one message at a time.

Say weather stalls a UPS hub and 30 customers text within minutes. Each answer holds the line for its send (normally 2–5 s) plus under 2 s of typing, so the last answer goes out roughly 1 to 3½ minutes after the burst starts. The handler skips typing while the line is busy, and console replies wait in the same queue.

Answering a customer who texted about an order is the purpose of the thread; promotions are not. ZeroSettle’s docs: “Do not send automated marketing into a support thread. It is a different consent, and it is how support lines get reported as spam.” ZeroSettle’s docs add that in the US, marketing texts generally need written consent and that nothing promotional should go out before 8 am or after 9 pm in the customer’s time zone; rules vary, so check yours with counsel. This isn’t legal advice.

When ZeroSettle is not a fit for order-status support

ZeroSettle is the wrong tool for order-status support when nobody can run a handler or most buyers can’t receive iMessage.

• You want a no-code answer. The hosted AI agent has no built-in order lookup.
• Most customers use Android. iMessage is Apple-only and other phones get SMS or RCS, the sms: link opens their SMS app, and ZeroSettle has no SMS fallback, so keep email or chat for them.
• Your orders rarely carry a phone number. The handler matches the sender to the order’s phone, so with email-only checkouts most texts go to a person.
• You would send promotions into the support thread. That needs separate consent.
• You need a native Shopify app. There is none; you build and host the handler.

How much does iMessage for order-status support cost?

Order-status support costs the plan price: ZeroSettle does not charge per message, and a handler you run uses no AI credits.

Both carry a 30-day money-back guarantee on the subscription. Hosted-agent texts use AI credits: 1,000 a month on Pro, 5,000 on Growth, and packs of 1,000 for $50 or 5,000 for $200. See ZeroSettle pricing or get a number.