Shopify Webhooks

When to Use This Skill

• Setting up Shopify webhook handlers
• Debugging signature verification failures
• Understanding Shopify event types and payloads
• Handling order, product, or customer events

Verification (core)

Shopify signs the raw body with HMAC-SHA256 keyed on the app's API secret and sends the digest in X-Shopify-Hmac-SHA256 as base64 (not hex). Pass the raw body, decode base64, and compare timing-safe. The topic is in X-Shopify-Topic; the shop domain in X-Shopify-Shop-Domain.

Node:

const crypto = require('crypto');