Shopify webhook verification, retries and deduplication

How do I verify a Shopify webhook HMAC in Node?

import { createHmac, timingSafeEqual } from 'node:crypto';

/** Shopify: HMAC-SHA256 over the raw body, base64 in X-Shopify-Hmac-Sha256. */
export function verifyShopify(secret, header, rawBody) {
  const expected = createHmac('sha256', secret).update(rawBody).digest('base64');
  const a = Buffer.from(expected, 'base64');
  const b = Buffer.from(String(header ?? ''), 'base64'); // compare the bytes, not the strings
  return a.length === b.length && timingSafeEqual(a, b);
}

Which secret signs a Shopify webhook?

How does Shopify retry a failed webhook?

import express from 'express';
import { verifyShopify } from './verify-shopify.mjs';

const app = express();

// Five seconds for the whole request, one of them for the connection. Nothing
// slower than a database insert belongs inside this function.
app.post('/webhooks/shopify', express.raw({ type: 'application/json' }), async (req, res) => {
  if (!verifyShopify(process.env.SHOPIFY_CLIENT_SECRET, req.get('x-shopify-hmac-sha256'), req.body)) {
    return res.status(401).send('hmac mismatch');
  }

  // CREATE TABLE shopify_webhooks (
  //   webhook_id text PRIMARY KEY, event_id text, topic text NOT NULL, shop text NOT NULL,
  //   triggered_at timestamptz, payload jsonb NOT NULL, processed_at timestamptz);
  const { rowCount } = await db.query(
    `INSERT INTO shopify_webhooks (webhook_id, event_id, topic, shop, triggered_at, payload)
     VALUES ($1, $2, $3, $4, $5, $6) ON CONFLICT (webhook_id) DO NOTHING`,
    [
      req.get('x-shopify-webhook-id'),
      req.get('x-shopify-event-id'),
      req.get('x-shopify-topic'),
      req.get('x-shopify-shop-domain'),
      req.get('x-shopify-triggered-at'),
      JSON.parse(req.body),
    ],
  );

  res.status(200).end(); // a retry of the same delivery lands on the same primary key: rowCount 0
});

Which header do I deduplicate on: X-Shopify-Webhook-Id or X-Shopify-Event-Id?

What do I do about the deliveries Shopify gave up on?

# After an outage longer than Shopify's four-hour retry window, the missed
# changes are not coming back on their own. Ask the Admin API for everything
# updated since the outage began and feed it through the same handler.
curl -s "https://$SHOP.myshopify.com/admin/api/2025-07/orders.json?status=any&updated_at_min=2026-09-07T02:00:00Z&limit=250" \
  -H "X-Shopify-Access-Token: $SHOPIFY_ACCESS_TOKEN"

Receive Shopify webhooks through a verified HookGet source

Receiving Shopify webhooks through HookGet

The contract

Setting it up

# 1. create a verified source; the secret is shown once
curl -X POST https://api.hookget.com/v1/sources \
  -H "authorization: Bearer $HOOKGET_KEY" \
  -H "content-type: application/json" \
  -d '{"provider":"shopify","name":"Production"}'

# {"id":"src_…","secret":"whsec_…","ingest_path":"/ingest/src_…"}

1. In the Shopify admin, open Settings → Notifications → Webhooks, or create the webhook through the Admin API.
2. Paste the ingest URL as the destination and the source secret as the shared secret.
3. Pick the topics you need; the topic header names the event on our side.

What you get after verification