Shopify relies on webhooks to keep external inventory, ERP, and shipping systems in sync with orders. Because order events represent financial transactions, HMAC validation is mandatory.
The single biggest cause of Shopify signature failures is encoding. Almost all other providers (GitHub, Razorpay) encode their HMAC output as a hexadecimal string. Shopify encodes theirs in Base64.
The Fix: Digest as Base64
const computedHmac = crypto\n .createHmac('sha256', process.env.SHOPIFY_SECRET)\n .update(req.body)\n .digest('base64'); // NEVER 'hex'!Shopify sends all webhooks to a single endpoint, relying on the X-Shopify-Topic header to differentiate between orders/create and products/update. Always implement a highly performant switch-case or router based on this header before parsing the heavy JSON payload.
Was this page helpful?
Your feedback helps us improve the docs.