Changelog

You can now remove uploaded logos, images and attachments you have finished with. Until now a file could only be removed as a side effect of editing the layout that used it, which was no help when you simply wanted to clear out an old logo.

In the app

Open the media picker anywhere you insert an image or attachment - the logo field in Branding, or Insert image in a layout. Every file now has a delete button in its corner. Confirm, and it is removed from storage for good.

Deleting a file that is still in use is refused, and we tell you what is using it

This part is deliberate. The picker lets you reuse one upload across as many layouts as you like, so removing a file that is still referenced would quietly break a different email that is still going out to your customers. If a layout or a shared header/footer preset still uses the file, the delete is refused and the message names them. Take the file out of those, then delete it.

Anything nothing references deletes straight away.

For the API and MCP

• GET /api/v1/files lists your files. Add ?usage=true and each one reports whether anything still references it, so you can find everything safe to clear out in one call.
• DELETE /api/v1/files removes one, applying the identical in-use check.
• The same is available to an AI assistant over MCP as list_files and delete_file. You can ask it to find and remove your unused images, and it cannot delete one a live email still needs.

See REST API reference.

Also fixed

Saving a layout used to tidy up files it no longer needed, but only checked other layouts - not shared header/footer presets. A logo used solely by a preset could be removed. Both paths now run the same check.

Manage your actions from your own code, or from an AI assistant like Claude or Cursor.

Developer API

• A new Developer page where you create API keys and get a ready-to-copy connect command for Claude Code, Claude Desktop, Cursor, VS Code or Gemini CLI.
• A REST API to manage HTTP request actions, and to read your email layouts, senders, secret names, execution history and stats.
• An MCP server, so an AI assistant can do the same in conversation - including writing a new action for you that references your existing secrets by name.
• Three access levels. Read keys can only look. Write keys can also create, update and delete actions. Execute keys can additionally run a configured HTTP request for real, which sits behind its own level because it sends a live request to a third-party system.

Both surfaces are served from a dedicated address, shopify.workflow-transactional-email.app, so your integrations do not depend on the app's admin URL.

Your credentials stay private. Secret values, SMTP passwords and OAuth tokens can never be read back through the API or MCP at any access level. An assistant can see that a secret named stripeApiKey exists and reference it as {{ secrets.stripeApiKey }} without ever seeing its value. Personal data in execution history is masked before it leaves the server, though free-text fields can still carry customer details.

Full documentation: Developer API and MCP, Authentication and API keys, REST API reference and Connect an AI assistant (MCP).

Links in the rich text editor are much less fiddly

Both of these came from a merchant report.

• Highlight text to link it. Select any text, click the link button, and the link is applied to that text - the address no longer has to be visible in the email. There is also a Remove link option when your cursor sits inside an existing link.
• Email addresses and phone numbers now work. You no longer type the scheme yourself. Enter [email protected] and it becomes a mailto link; enter (703) 638-2601 and it dials; enter yourstore.com and it opens as a normal web address. The dialog tells you what it will do before you insert it.

What was actually wrong, since it caused both problems: an address typed without https:// was treated as relative to the Shopify admin page rather than as a real web address. That produced a broken link, so the only way to get a working one was to type the full URL - and an email address could never become a mailto at all. Fixed at the root.

Your existing layouts and saved links are untouched.

A proper page after upgrading

Upgrading used to drop you back on the dashboard with no confirmation. There is now a page that confirms the change, shows what your new plan includes and how much of it you have used, and points you at the next useful thing to set up.

Two formatting fixes in the visual builder, both reported by a merchant.

Line breaks now work in header and footer text

• The footer printed a typed <br> as literal text while separately acting on your Enter key, so you got a line break and a stray <br> on screen.
• The header ignored line breaks altogether and ran everything onto one line.

Both are fixed. Press Enter for a new line - typing <br> also works if that is your habit. This applies to your existing layouts straight away, with nothing to change.

Spacing between blocks

Every block carried padding on all four sides on top of the gap between blocks, which stacked up to around 44px between elements and made emails look loose.

Padding is now split, with a new Block Padding (top & bottom) slider under Branding → Layout alongside the renamed Block Padding (sides). Each spacing control now explains what it actually does.

• Existing layouts are untouched. They keep exactly the spacing they have today, so nothing shifts in emails you have already tuned. To tighten one up, drop the new slider - around 4px works well.
• New layouts start tight by default: roughly 20px between blocks instead of 44px.

This release is about one thing: knowing your email is right before a customer tells you it is not.

Preview text

• Every layout now has a Preview text field - the line email clients show next to the subject in the inbox. Leave it empty and the client grabs whatever text comes first in your email, which is usually "View in browser".
• Supports the same {{ variables.xxx }} as the subject, so it can carry the delivery date or the order number.
• Description now says what it actually is: an internal note only you can see. Several merchants had been writing customer-facing copy there.

See Subject line and preview text.

We now warn you when a variable renders blank

Templates render leniently on purpose, so a wrong or missing variable never blocks a customer's email. The cost was that it produced a silent blank: the send succeeded, History went green, and only the recipient saw the gap.

• A send where a placeholder produced nothing is now badged Empty variables in History.
• Opening it names exactly which ones, and separates two very different problems: sent by Flow but empty (wrong property path) versus not sent by Flow at all (missing from your JSON).
• Applies to HTTP requests too.

The Variables (JSON) is now written for you

Hand-writing that JSON was the single biggest source of support tickets.

• Every layout has a Use in Shopify Flow card with the exact JSON to paste into the Flow action, with all key names already correct. One button copies it.
• Common fields are pre-filled - customer name, order name, order total, status page URL.
• If a variable looks like line-item data, it warns you: an order has many line items, so {{ order.lineItems.variant.title }} returns nothing and needs a loop. This is the most common cause of an empty variable.
• Test Variables now state plainly that they only affect previews and test sends - a live Flow run ignores them.

See Passing data from Shopify Flow.

You can delete things again

Layouts, senders, SMTP servers, HTTP requests, secrets and presets used to be undeletable while a Shopify Flow step referenced them.

The problem: that reference is remembered until the app is uninstalled, so it was often a leftover from a workflow you had already deleted or rebuilt - and nothing could tell the difference. Merchants were stuck with records they could not remove.

• Deletes are no longer blocked. You get told what still references the item, and you decide.
• A Flow step pointing at something deleted now fails with a clear message in History rather than being prevented up front.
• Uploaded files are the one exception: the same file can be shared across layouts, so that check stays.

Steadier under load

• Added per-store admission control and autoscaling to the action endpoints, so one workflow firing in a burst can no longer slow down everyone else.
• The app now returns the right signals to Shopify Flow when it is busy, so Flow paces its retries instead of hammering - nothing is dropped.
• Hitting your plan limit now returns a clear, final answer rather than being retried for hours.

Smaller things

• Insert image → Paste a link in the rich text / HTML editor is fixed: there is now a cancel button, Enter inserts, Escape backs out, and the Insert button is disabled until you have typed something. Pasting a bare cdn.example.com/logo.png works - the https:// is added for you.
• The setup guide now uses the real Flow action names, Send Transactional Email and HTTP Request.
• Routine security maintenance: dependency updates across the app, including one critical and three high-severity advisories. No action needed.
• New documentation: Install and set up, Email deliverability (why a successful send can still land in spam), Sidekick and AI assistants, and Data, privacy and security.

Getting help no longer means hunting for an email address.

In-app chat, on every page

• The chat bubble is now available everywhere in the app, not just the dashboard. Start a conversation from wherever you are - mid-way through building a layout, or staring at a failed action in History.
• We already know who you are. Your store, plan and contact details come through automatically, so you do not have to explain which shop you are writing from.
• It gets out of the way. The bubble hides itself whenever a dialog is open, and while you are in the visual email builder, so it can never sit on top of a Save button.

New documentation site at docs.workflow-transactional-email.app

• Full setup walkthroughs, with video guides, for all three sender types: your own Send email from Shopify Flow with a custom SMTP server, Send email from Shopify Flow with Microsoft 365, and Send email from Shopify Flow with Google.
• A complete Build an email layout reference covering every block in the visual builder, branding settings, and the rich text / HTML mode.
• Variables and Liquid - the full templating reference, including loops, conditionals, and why an object renders differently in an email than in an HTTP request.
• Make an HTTP request from Shopify Flow - a full worked Airtable example, video included, showing how to call an external API from Flow on any Shopify plan.
• New pages for Email senders overview, Attachments and images, Header and footer presets, Secrets, Notifications and alerts and Plans and usage.
• History and troubleshooting and a Frequently asked questions covering the failures we actually get asked about.

New Help Center - report a bug, request a feature, or contact us through a proper form that reaches us directly, with screenshots attached. The Help page in the app now links straight to all of them.

The old documentation at docs.flow-action-extensions.app has been carried over in full, so nothing you had bookmarked is lost - it just lives under the new name now.

Flow Transactional Email is now Workflow Transactional Email. Same app, same install, same senders and templates - a new name, matching the rest of our Workflow range.

Nothing to do on your side. Your Shopify Flow workflows keep working untouched.

One thing worth knowing: the Microsoft and Google consent screens may still show the previous name, Flow Action Extensions. That is expected, and safe to approve.

Ask Shopify Sidekick about your emails

Sidekick can now answer questions about this app directly. Ask things like "which email senders are set up", "did any emails fail this week", "do I have an HTTP request for Airtable", or "why did my last send fail".

Read-only - Sidekick can look at your templates, senders, requests and history, but cannot change anything. It never returns secret values, SMTP passwords, OAuth tokens or message contents.

Routine security maintenance: dependency updates and hardening across the app. No action needed.

Included in this pass: outbound requests configured by merchants are checked against internal and private network addresses before connecting, and rendered email HTML is sanitised before sending.

• Header and footer presets. Design your branded header and footer once, then reuse them across every email layout. Change the preset and every template using it updates - so a new logo or a changed company address is one edit, not twenty.
• Header layouts run from logo-only to logo with tagline and navigation links. Footers cover social icons across 13 platforms, custom legal text, copyright and unsubscribe.
• Custom fonts. Upload your brand's heading and body fonts and they appear in the builder's font picker alongside the built-in system and Google fonts.
• Email layouts now show their type at a glance in the list, so you can tell a visual build from an HTML one without opening it.
• Fixed media picker cards rendering unevenly on mobile, and filenames being cut off.
• Fixed an intermittent failure loading files in the picker, which could show "Failed to load files" until the page was reloaded.

Media library

• A single picker for every image and file in the app, with search, type filtering and sorting. Upload your logo once and reuse it across every template and block.
• Uploads now go straight to storage rather than through the app, so large files no longer stall the page.
• A storage usage bar shows how much of your plan's allowance you have used.

Deletes that cannot silently break things

Deleting a template, sender, SMTP server or secret that a Shopify Flow step still points at used to leave that workflow quietly broken - it would keep running and keep failing.

• Every delete now checks for references first. If something is in use, the delete is blocked and the app tells you exactly what to update.
• Files are checked the same way, so removing an image from one template cannot break another that reuses it.

Also

• Per-store attachment storage caps, with clear messaging when you reach one.
• An access trail for any read of an encrypted credential.

The biggest change since launch: you no longer need SMTP credentials at all.

Connected accounts

• Microsoft 365 and Google can now be connected with one click from Email senders → Connected accounts. Sign in once, approve access, and send on behalf of that mailbox. Tokens are refreshed automatically in the background.
• Covers more than your own inbox: Microsoft shared mailboxes and group mailboxes, and Google "Send mail as" aliases, each shown with its own badge.
• Send test email from the Email senders page confirms a mailbox works before you wire it into a workflow.

Why this matters: app passwords and stored SMTP credentials are a liability - they expire, they get rotated, and they sit in a database. OAuth removes all three problems, and mail sent through your own provider inherits your own domain reputation.

A new attachment system

• Attachments now work in plain text and HTML layouts as well as visual ones.
• Up to 20 MB across all files on a template. Anything above that is automatically offered as a download link in the email footer instead of an inline attachment.

A pass over every screen to meet Shopify's Built for Shopify standard, so the app behaves the way the rest of your admin does.

• Unsaved changes are protected. Every form now uses Shopify's native save bar. Navigating away or switching tabs with pending edits prompts you first, rather than quietly discarding your work.
• Native back navigation throughout, so the browser and admin back buttons go where you expect.
• Consistent use of toasts for confirmations and inline errors for validation, instead of banners competing for attention.
• Critical (red) styling is now reserved for genuine errors and destructive actions, so a red badge always means something is actually wrong.
• Reworked dashboard with metric cards, a date range picker and an events chart.

The app now runs on a new European cloud platform. Nothing changes in how you use it, but underneath:

• Databases and caches are region-local in the EU, with encryption at rest.
• Your credentials - SMTP passwords, OAuth tokens and secrets - are now individually encrypted with a dedicated key management service, on top of disk-level encryption. Plaintext is never stored.
• Redundant instances across availability zones, with automatic scaling under load.
• Faster action execution, and far better behaviour when a lot of workflows fire at once.

• Rich text editing - write an email body with a normal formatting toolbar instead of raw HTML, and switch to HTML whenever you need full control.
• In-app chat - reach us from inside the app without hunting for an email address.
• Fixed Liquid rendering edge cases where certain values were not substituted correctly.
• Fixed saving an HTTP request with an empty body, which previously failed for endpoints that legitimately take none.
• Improved how HTTP requests are processed under load, so a burst of Flow runs no longer slows the queue behind it.

Writing HTML by hand is a poor way to design an email. So now you do not have to.

Visual email builder

• Build a layout from blocks - heading, text, image, button, divider and spacing - and see it render live next to the settings panel.
• Layout blocks: put an image beside text, or split a row into two columns with configurable widths and gaps.
• Branding settings for colors, fonts, spacing and content width apply across the whole email.
• Test variables let you preview the design with realistic data before sending anything.

Export and import

• Export any email template and import it into another store. Useful for agencies running the same design across several clients, and for keeping a backup of a layout you spent real time on.

The first release. Shopify Flow can automate plenty inside Shopify, but it cannot reach out - this adds two actions that can.

• Send Transactional Email - send branded email from your own SMTP server. Gmail, SendGrid, Mailgun, Amazon SES, or your own mail server.
• HTTP Request - call any external API, webhook or service. GET, POST, PUT, PATCH and DELETE, with custom headers and a JSON body. Works on every Shopify plan, including Basic, where Shopify's own HTTP action is not available.
• Secrets - store API keys, tokens and passwords once and reference them anywhere as {{ secrets.keyName }}. Never exposed in templates, configuration or logs.
• Liquid templating - build dynamic subjects, bodies, URLs and payloads from Flow data with {{ variables.xxx }}.
• Email templates - reusable subject and HTML body, so one design serves every customer.
• Event history - every execution logged with its request and response detail, plus usage, plan limit and success-rate cards on the dashboard.
• No Shopify permissions - the app requests no access scopes and never reads your shop data.