Shopify webhooks

Q: What happens if Shopify sends the same event twice?

Redeliveries are deduplicated on X-Shopify-Webhook-Id , namespaced per source, so a repeat becomes the same event rather than a second one.

Orders, products, customers and app lifecycle events, verified with Shopify’s own HMAC.

In short

Verification: the provider’s own HMAC signature over the raw body.
Deduplication: X-Shopify-Webhook-Id.
Once verified, the event joins your catalogue with the same retries, log and replay as anything you publish yourself.

The contract

Field	Value
Provider key	`shopify`
Header checked	`X-Shopify-Hmac-Sha256: <base64>`
Scheme	HMAC-SHA256 over the raw request body, base64-encoded, compared in constant time.
Deduplicated on	`X-Shopify-Webhook-Id`
Event type	`X-Shopify-Topic` becomes `shopify.orders.create` and similar.

Setting it up

# 1. create a verified source; the secret is shown once
curl -X POST https://api.hookget.com/v1/sources \
  -H "authorization: Bearer $HOOKGET_KEY" \
  -H "content-type: application/json" \
  -d '{"provider":"shopify","name":"Production"}'

# {"id":"src_…","secret":"whsec_…","ingest_path":"/ingest/src_…"}

In the Shopify admin, open Settings → Notifications → Webhooks, or create the webhook through the Admin API.
Paste the ingest URL as the destination and the source secret as the shared secret.
Pick the topics you need; the topic header names the event on our side.

Worth knowing. Shopify computes its HMAC over the exact bytes it sent. Any middleware that reformats JSON before verification breaks the check — verify first, parse second.

What you get after verification

The event appears in your log with a namespaced type, so Shopify traffic never collides with your own.
It fans out to your destinations with the same retry schedule and dead-letter behaviour as any other event.
The source secret rotates with an overlap window, so you can update Shopify at your own pace.
Each inbound source is rate limited on its own, so a busy provider cannot exhaust your publish budget.

Questions

How do I verify a Shopify webhook?

HMAC-SHA256 over the raw request body, base64-encoded, compared in constant time. With HookGet you do not implement it: the source is created with a secret, and every request is checked against X-Shopify-Hmac-Sha256: <base64> before the event exists.

What happens if Shopify sends the same event twice?

Redeliveries are deduplicated on X-Shopify-Webhook-Id, namespaced per source, so a repeat becomes the same event rather than a second one.

What if verification fails?

The request is refused with 401 and nothing enters the pipeline. The rejection is logged on our side as a signal worth watching; the caller learns nothing beyond the status.