SHOPLINE Webhooks

When to Use This Skill

• How do I receive SHOPLINE webhooks?
• How do I verify SHOPLINE webhook signatures (X-Shopline-Hmac-Sha256)?
• How do I handle orders/create, products/update, or collect/delete events?
• Why is my SHOPLINE webhook signature verification failing?

Verification (core)

SHOPLINE (the SHOPLINE Open Platform, developer.shopline.com) signs every webhook with HMAC-SHA256 of the raw request body keyed on your app secret (Developer Center → App credentials) and sends the digest in the X-Shopline-Hmac-Sha256 header. Use the raw body — parsing JSON first changes the bytes and breaks the signature — and compare timing-safe.