CartWatch Privy Integration

What the integration does

CartWatch scores every Shopify checkout for bot behavior. With Privy connected and auto-suppression enabled, each flagged email address that exists in your Privy account is:

• Unsubscribed from email — the contact stops receiving newsletters, automations and follow-up sends.
• Unsubscribed from SMS — if the contact has a phone number in Privy, text campaigns stop too.

If a flagged checkout is later updated and scores below the threshold, CartWatch resubscribes the contact so it is back to normal. Privy's welcome text is not re-sent when that happens.

Connecting

Privy has no app-authorization screen for third-party apps. Instead, every Privy account can create its own OAuth application, and CartWatch connects with that application's credentials. It takes a minute longer than a one-click connect, but the access it grants is exactly as narrow: contacts only, and only the scopes you tick.

1. Install CartWatch from the Shopify App Store if you haven't already.
2. In Privy, open Settings → API → API Tokens and create a new OAuth application. Name it something like “CartWatch”.
3. Give the application the contacts_read and contacts_write scopes. New applications start with no scopes, and CartWatch needs both: one to find the contact, one to unsubscribe it. It does not need event or order scopes.
4. Copy the Client ID and the Client Secret. Privy shows the secret only once; if you lose it, regenerate it from the application's settings in Privy.
5. Open Settings in CartWatch.
6. In the Privy Integration card, paste both values and click Connect Privy. CartWatch checks the credentials against your Privy account before saving them.

Managing the integration

All Privy-specific settings live in the Privy Integration card in CartWatch Settings:

• Auto-suppress bots in Privy — toggle whether flagged checkouts are unsubscribed automatically.
• Disconnect Privy — deletes the stored Client ID, Client Secret and access token so CartWatch stops touching your account. You can reconnect at any time with the same or a new application.

To remove CartWatch's access on the Privy side as well, delete the OAuth application you created under Settings → API → API Tokens in Privy, or regenerate its secret.

Troubleshooting

• “Privy rejected these credentials” — the Client ID or Client Secret was mistyped, the secret has since been regenerated, or the application was deleted in Privy. Open the application in Privy, regenerate the secret and paste the pair again.
• Credentials accepted but nothing is unsubscribed — almost always missing scopes. Open the application in Privy and make sure both contacts_read and contacts_write are enabled, then disconnect and reconnect in CartWatch so a fresh token is issued with both scopes. CartWatch keeps retrying a refused suppression for 24 hours, so recent bots catch up on their own once the scopes are right.
• A contact wasn't unsubscribed — suppression applies only to checkouts CartWatch flags as bots after Privy is connected, and only once the contact actually exists in your Privy account. If your Shopify store syncs contacts to Privy on a delay, CartWatch keeps checking for 24 hours until they appear.
• A cleared checkout's contact is still unsubscribed — Privy will not let an app resubscribe a contact it has compliance-suppressed itself (for example after a spam complaint). That is Privy's rule, not CartWatch's.
• You deleted the application in Privy — every suppression will fail from then on and CartWatch will alert us. Create a new application and reconnect in CartWatch Settings.