Troubleshooting Shopify Webhook Signature Verification Failures

How Shopify Signs Webhooks

Shopify sends an X-Shopify-Hmac-Sha256 header containing the HMAC of the raw request body, computed with the webhook's shared secret.

Common Verification Failures

1. Verifying the parsed body instead of the raw bytes — JSON parsing reformats the string and breaks the HMAC.
2. Wrong secret — using the API key instead of the webhook secret.
3. Encoding differences — base64 vs hex mismatch.

Correct Verification (Node.js)

const crypto = require('crypto');
const digest = crypto
  .createHmac('sha256', process.env.SHOPIFY_SECRET)
  .update(rawBody, 'utf8')
  .digest('base64');
if (digest !== req.headers['x-shopify-hmac-sha256']) return res.status(401).end();

Inspecting the Payload

After verification, pretty-print the payload with the FormatHub Shopify Webhook Formatter to audit line items and customer metadata.