TikTok Shop Webhooks

When to Use This Skill

• How do I receive TikTok Shop webhooks?
• How do I verify TikTok Shop webhook signatures?
• How do I handle ORDER_STATUS_CHANGE or PACKAGE_UPDATE events?
• Why is my TikTok Shop webhook signature verification failing?
• Setting up TikTok Shop webhook handlers and event subscriptions

Verification (core)

TikTok Shop puts the signature in the Authorization header (no Bearer prefix) as a lowercase-hex HMAC-SHA256. The signed message is your app_key concatenated with the raw request body, keyed by your app_secret. Verify against the raw body exactly as received — don't JSON.parse first.