Nuvemshop (Tiendanube) Webhooks

When to Use This Skill

• How do I receive Nuvemshop / Tiendanube webhooks?
• How do I verify Nuvemshop webhook signatures?
• How do I handle order/created, order/paid, or order/cancelled events?
• Why is my x-linkedstore-hmac-sha256 verification failing?
• Setting up a webhook receiver for a Nuvemshop app

Verification (core)

Nuvemshop signs the raw request body with HMAC-SHA256 keyed on your app's client secret (the OAuth app secret from the Partners Portal) and sends the digest hex-encoded in the x-linkedstore-hmac-sha256 header. Compute the HMAC on the exact raw bytes before JSON parsing and compare timing-safe.

There is no official SDK — verification is manual in every language.