Shopify Webhook-Testguides

Replay + Signatur-Helper (Dashboard)

Open /dashboard or /dashboard/tunnels and use Webhook Command Center for this provider. It gives one-click replay and signature verification helpers.

instatunnel webhook verify --provider shopify --secret-env SHOPIFY_WEBHOOK_SECRET

curl -i -X POST "https://YOUR-SUBDOMAIN.instatunnel.my/webhooks/shopify" -H "Content-Type: application/json" --data-binary @sample-shopify.json

Required signature header: x-shopify-hmac-sha256

1. Lokales App-Setup

Create a local webhook endpoint at: /webhooks/shopify

import express from 'express'
import crypto from 'crypto'

const app = express()
app.post('/webhooks/shopify', express.raw({ type: 'application/json' }), (req, res) => {
  const hmac = req.header('x-shopify-hmac-sha256') || ''
  const rawBody = req.body as Buffer
  const digest = crypto
    .createHmac('sha256', process.env.SHOPIFY_WEBHOOK_SECRET!)
    .update(rawBody)
    .digest('base64')

  const hmacBuf = Buffer.from(hmac)
  const digestBuf = Buffer.from(digest)
  const valid = hmacBuf.length === digestBuf.length && crypto.timingSafeEqual(hmacBuf, digestBuf)

  if (!valid) {
    return res.status(401).send('invalid hmac')
  }

  console.log('shopify topic:', req.header('x-shopify-topic'))
  res.status(200).send('ok')
})

app.listen(3000, () => console.log('listening on :3000'))

2. InstaTunnel-Befehl ausfuhren

instatunnel 3000 --subdomain shopify-dev

Keep a fixed subdomain so your provider dashboard URL does not keep changing.

3. Provider-Felder zum Einfugen

Use the helper below to generate exact values with your chosen subdomain and path.

4. Testevent senden

1. In Shopify Admin webhook settings, click "Send test notification".
2. For app webhooks, use Shopify CLI trigger commands in a dev store.
3. Confirm your endpoint logs topic, shop domain, and a 2xx response.

# Shopify CLI example (event names vary by app setup)
shopify app webhook trigger --topic orders/create

5. Signatur prufen

Verify this header on every request: x-shopify-hmac-sha256

const digest = crypto
  .createHmac('sha256', process.env.SHOPIFY_WEBHOOK_SECRET!)
  .update(rawPayloadBuffer)
  .digest('base64')

const valid = Buffer.from(req.header('x-shopify-hmac-sha256') || '').length === Buffer.from(digest).length &&
  crypto.timingSafeEqual(Buffer.from(req.header('x-shopify-hmac-sha256') || ''), Buffer.from(digest))
if (!valid) return res.status(401).send('invalid hmac')

6. Retries und Idempotenz

• Use webhook ID + topic + timestamp as dedupe keys.
• Process asynchronously and return 200 quickly.
• Treat webhook deliveries as at-least-once and potentially out-of-order.

7. Haufige Fehler und schnelle Fixes