Automated B2B Onboarding: Shopify Plus + Real-Time VIES VAT Validation

The problem

Benfida serves professional customers — pharmacists, therapists, doctors, and wholesalers — across Belgium, the Netherlands, France, and Luxembourg. Each new professional application required a cascade of manual administrator steps:

• Verify the VAT number against the EU VIES database
• Link the correct price catalog based on billing country (different rates for BE, NL, FR, LU)
• Activate intracom VAT exemption for EU businesses outside Belgium
• Set the payment term: immediate checkout or NET 30
• Check whether the professional already had a Shopify customer account to avoid duplicates

With a growing professional customer base, this manual flow was no longer viable. The solution: a fully custom registration platform that automates every step.

The architecture

The system is a Node.js/Express API server hosted on DigitalOcean App Platform, with automatic deploys from GitHub. It handles form submissions, validates and enriches the data, and communicates directly with the Shopify Plus GraphQL API via an OAuth token.

9-step processing pipeline

Step 1 — Email pre-check Before the form is filled out, the email address is checked against the Shopify API. Does a B2B account already exist? The user immediately receives a login link and further registration is blocked.

Step 2 — Form validation (Zod) All fields are validated server-side via a strict Zod schema: address structure, VAT format, country codes, and payment terms. Missing or incorrect data is reported back with precise per-field error messages.

Step 3 — VAT cleanup & auto-prepend Annotations like (ondernemingsnummer) are automatically stripped. For BE and LU, the country code is automatically prepended. The frontend already performs the VIES lookup when the professional leaves the VAT field — they see their data confirmed before submitting the form.

Step 4 — VIES validation (EU SOAP API) The cleaned VAT number is verified via the European VIES database. On confirmation, company name and address are auto-filled. If VIES is temporarily unavailable, the application is still accepted — but the administrator receives a ⚠️ flag in the notification email for manual review.

Step 5 — Intracom determination Automatic detection of whether an EU company outside Belgium qualifies for VAT exemption via intracom reverse charge. Relevant for wholesalers in the Netherlands, France, and Luxembourg.

Step 6 — Shopify company creation (companyCreate) The complete company profile is created, including billing and shipping address, VAT registration number, and contact person. An existing Shopify customer is automatically linked as a contact via companyAssignCustomerAsContact.

Step 7 — Catalog linking (non-blocking) Based on the billing country, the correct price catalog is automatically linked via catalogContextUpdate. A failure at this step does not block the registration — the link is logged for follow-up.

Step 8 — Payment term configuration (conditional) If the professional selected NET 30, the payment template is set automatically via companyLocationUpdate — exclusively when the VAT number was confirmed live by VIES. Without confirmation, the option is hidden in the form.

Step 9 — Notification and welcome email The administrator receives a structured HTML email with all company details, a direct link to Shopify Admin, and any VIES warnings. The professional receives a bilingual welcome email (NL/FR) with a login link.

Smart UX & security

UX decisions:

• Fully bilingual (NL/FR): Automatic language detection via URL parameter. All validation messages, banners, and emails are sent in the chosen language.
• Progressive disclosure: The form reveals only relevant sections step by step. The payment term choice appears only for professionals with a VIES-confirmed VAT number.
• Auto-lookup on blur: The VAT field automatically triggers a VIES lookup when the professional leaves the field — no button required.

Security:

• API key protection: Every form submission requires an X-API-Key header. Requests without a valid key are rejected with HTTP 403.
• Rate limiting: Separate limits on the email check endpoint (30 req/15 min) and the registration endpoint to prevent abuse.
• Server-side revalidation: All client-side validation is repeated server-side via Zod. The client can never push an invalid state through.

Results

Every new B2B professional is fully automatically onboarded: VAT verified, company created, correct catalog linked, payment terms set, and welcome email sent — with zero manual intervention from the Benfida team. Only applications with an unverifiable VAT number are flagged for manual follow-up.