Why does my Shopify orders/create webhook come through with no customer email?
If orders/create comes through without an email address, it's almost always a protected customer data approval you haven't requested yet, not a broken webhook.
What's going on
You've wired up an orders/create webhook and it fires reliably on every checkout, but the payload's email field is empty, null, or missing entirely, even though the customer's email is sitting right there on that same order in the Shopify admin. The order ID, line items, totals, and shipping address usually look fine; it's specifically the customer contact fields, especially email, that come through blank.
This almost always traces back to Shopify's protected customer data requirements. Shopify treats fields like email, phone, name, and physical address as data any app, public or custom, must be separately approved to receive, on top of whatever access scopes (read_orders, read_customers, and so on) the merchant granted during install. Without that separate approval, Shopify doesn't return an error, it silently redacts those fields from every API response and webhook payload sent to that app.
Because the payload still arrives successfully and everything else in it looks normal, this often gets mistaken for a bug in the webhook subscription, the API version, or the order itself, when it's actually a data access permission that lives in a different part of the Partner or Dev Dashboard than the app's install scopes.
Why it happens
Shopify separates whether an app can see order data at all from whether it can see personal customer data within that order. An app can have full read_orders access and still receive a completely redacted email, phone, name, and address on every order until it's separately approved for protected customer data, and approved for each individual protected field it wants to receive.
That approval is requested from the Partner Dashboard (or the newer Dev Dashboard), and it requires a short explanation of why the app needs each field. It isn't automatic, it isn't tied to the merchant's install consent screen, and it's easy to miss if the app was built before this requirement existed, or if only the general protected customer data toggle was requested without the specific fields underneath it.
5 ways to fix it
Request Protected Customer Data access for your app
This resolves almost every case of a missing email field, and it costs nothing. In the Partner Dashboard (or the newer Shopify Dev Dashboard), find the API access / protected customer data request for your app and submit it, along with the short explanation Shopify asks for about why you need each field. Review typically takes a couple of days. Until your app is approved, Shopify redacts protected fields like email, name, phone, and address from API responses and webhook payloads it sends to that app, no matter what access scopes (such as read_orders) the merchant granted at install.
Make sure you requested the specific field, not just the general category
Protected customer data approval and approval for each individual field (email, phone, name, address) are separate steps in the same request flow. It is easy to get general approval while leaving email unchecked, which leaves that one field redacted even though everything else populates correctly. Go back through your request and confirm email is explicitly listed and approved, then place a test order to verify it actually shows up in the payload.
Recreate the webhook subscription after approval clears
Some developers have found that a webhook created before their app was approved for protected customer data keeps returning a redacted email even after approval comes through, as if the subscription were still tied to the app's earlier access state. If email is still missing once you're approved, delete and recreate that webhook subscription through the API rather than just leaving the existing one in place, and make sure your app is on a reasonably current API version.
Confirm the order actually has an email before assuming it's a permissions bug
Not every missing email is an access problem. Point-of-sale orders with no customer attached, guest checkouts where the buyer skipped entering an email, and some draft orders can legitimately have no email at all. Open that same order in the Shopify admin: if the email field is blank there too, the webhook is passing through exactly what exists, and there's nothing to fix on the access side.
Use an Admin API lookup as a stopgap while your request is pending
If you need the data before approval comes through, you can have your webhook handler trigger a follow-up Admin API query for that order or customer as soon as the event arrives. This will not bypass the protected-data requirement, the response will be redacted the same way until you're approved, but having the pattern in place means no further code changes are needed once approval lands and the field starts populating.
Bottom line
If your orders/create webhook comes through with a blank or missing email, the cause is almost always that your app hasn't been approved for protected customer data access, not a bug in the webhook itself or something wrong with the payload structure. Request that access, along with each specific field you need, confirm approval, and recreate the webhook subscription if the field still doesn't appear. Only after ruling that out should you treat it as a genuinely email-less order, like a guest checkout or an in-store sale with no customer attached. This is a configuration step any store or developer can resolve directly through Shopify, without needing a third-party app or workaround.
Browse the rest of the problem library, run a free storefront scan to catch issues like this automatically, or email us and we'll work out a custom solution for it.