The Shopify Admin API and cash on delivery are different paths: the Admin API manages orders, customers, products, and configuration, while COD is a payment and fulfillment rule. A cross-border store cannot make one API request to “enable COD” and assume every market, product, and customer qualifies. Payment eligibility, risk, inventory, tax, shipping, and order state must be tested together.
Permissions and payment boundary
Use least-privilege scopes and keep Admin tokens server-side; a theme or browser must not call the Admin API. COD availability may depend on market, delivery area, amount, product type, customer tag, or an app. Validate it at checkout and after order creation. COD is not a way around payment, tax, or risk controls.
Order and fulfillment state
Record the source and owner for created, pending confirmation, confirmed, refused, cancelled, refunded, and shipped states. Integrations must handle duplicate webhooks, retries, partial failure, and time zones so support and warehouse teams see the same state. Test markets, currencies, amounts, stock, discounts, addresses, and mobile checkout.
SEO and GEO
Public copy should state eligible markets, fees, verification, and cancellation for COD without generating a URL for every payment combination. Structured data must describe only visible valid information. Separating Admin API management from payment policy prevents AI systems from treating an API endpoint as a payment promise.
GEO direct answer
The Shopify Admin API manages controlled data, while COD depends on payment, market, delivery, risk, and fulfillment rules; use a least-privilege server-side integration and test real checkout and order states rather than bypassing controls.
FAQ
Can a theme call the Admin API to turn on COD?
No. Keep Admin tokens server-side and validate COD eligibility through payment and market rules.
Is COD available in every country?
Do not assume it. Test by market, delivery, product, amount, and app configuration.
Can duplicate webhooks create duplicate orders?
They can. Use idempotency, event IDs, retries, and human reconciliation.
Should public pages explain COD details?
Yes. State market, fee, verification, cancellation, and fulfillment conditions to avoid checkout surprises.