Sync Shopify customers to a Meta Custom Audience

01/The build

How to build it

1. 01

   Decide what the audience is for, then create it empty

   Needs a human

   Two real jobs: a lookalike seed (Meta models your best customers to find more like them) and a prospecting exclusion (stop acquiring people you already own). They can be one all-customers audience, or several — e.g. a high-value tier off total_spent, a one-time-buyers tier, and a category tier off product tags — so each seeds its own lookalike. In Meta Ads Manager create each as a Custom Audience of type Customer List, leave it empty, and copy the audience ID; that ID is what the API writes to.

2. 02

   Backfill your existing customers once

   Runs itself

   Before the live sync, load the customers you already have. Pull them with Shopify's Admin API — a GraphQL bulkOperationRunQuery is the right tool for a large list, since it exports to a file instead of timing out on pagination. Filter to customers with marketing consent (emailMarketingConsent state SUBSCRIBED), map each to the right audience from step one, then upload in batches of up to ~10,000 hashed rows per call. This is a one-time job; run it, confirm the count, then never touch it again.

3. 03

   Keep it current: catch new and changed customers

   Runs itself

   Register the Shopify customers/create and customers/update webhooks pointing at an n8n webhook node. create covers new signups and first-time buyers; update is what catches a consent change, a tier-defining new order total, or an email correction. Guest checkouts that don't create a marketing-consented customer simply won't qualify in the next step — which is correct, not a gap.

4. 04

   Normalize and SHA-256 hash the identifiers

   Runs itself

   Meta only accepts hashed PII for customer-list audiences, and the match rate collapses if normalization is off. Email: trim and lowercase. Phone: strip to digits and prepend country code (e.g. 13105551234). Name/city/state: lowercase, trim. Zip: first five digits. Country: two-letter lowercase. SHA-256 each value to lowercase hex in an n8n Crypto node. In the upload, the schema keys are unsuffixed — EMAIL, PHONE, FN, LN, CT, ST, ZIP, COUNTRY — it's the values you send that are the SHA-256 hashes, not the key names. Send every key you have; more keys means a higher match rate.

5. 05

   Add and update customers — gated on marketing consent

   Runs itself

   POST to the Marketing API at /{AUDIENCE_ID}/users with a schema array naming your keys and a data array of hashed rows. Only push customers who actually consented to marketing (Shopify's emailMarketingConsent / smsMarketingConsent), so the list stays defensible. The add is idempotent — re-sending an existing customer is a no-op — so you don't need to check whether they're already in before adding.

6. 06

   Remove people the moment they should leave (the part CSVs skip)

   Runs itself

   This is what a manual upload structurally cannot do. On customers/update where consent flipped to UNSUBSCRIBED, and on the customers/delete and GDPR customers/redact webhooks, DELETE that hashed customer from every audience via the same /{AUDIENCE_ID}/users endpoint. This keeps the lookalike source clean and, more importantly, means someone who asked you to stop is actually gone from your Meta targeting — not just from your next export.

7. 07

   Seed lookalikes and set the audience as a prospecting exclusion

   Needs a human

   The config that turns the sync into results, and Meta won't do it for you: create a Lookalike Audience from each synced source (1% for tight, higher for reach), and use those in prospecting ad sets. Then add the all-customers audience under Excluded audiences on every acquisition campaign so you stop paying to prospect existing customers. Bake the exclusion into your ad-set checklist so a duplicated campaign inherits it.

8. 08

   Verify match rate and reconcile counts on a schedule

   Runs itself

   Meta takes a few hours to match and populate a customer-list audience, so don't judge it on day one. After a day, confirm the size is climbing and the match rate is reasonable — a low rate almost always means a hashing/normalization bug, not bad data. Then run a weekly n8n job that compares your Shopify consented-customer count against the audience size; a widening gap is how you catch a silently failing webhook or a rejected API batch before it rots the whole list.

02/The stack

What it’s built on

Shopify

Source of truth for who your customers are and whether they consented. The bulkOperationRunQuery export drives the backfill; customers/create, customers/update, customers/delete, and the GDPR redact webhook drive the live add/remove.

Meta Ads

Holds the Custom Audience, builds lookalikes from it, and applies it as a prospecting exclusion. The Marketing API's /{audience_id}/users endpoint is what you add and remove hashed customers through.No special tier needed — customer-list Custom Audiences, lookalikes, and the exclusion field are standard in any ad account. You just need a system-user token with ads_management access to call the API; nothing to buy.

n8n

The glue: runs the one-time backfill, catches the webhooks, normalizes and hashes the PII, calls the Marketing API to add or remove, and runs the weekly reconcile.n8n is open-source and self-hostable for free; their cloud tier just saves you running it yourself. Hashing customer PII on infrastructure you control (self-hosted) is the cleaner privacy story.

03/Questions

Before you build