Verify Webhook with Shopify Partner API

Pipedream makes it easy to connect APIs for Shopify Partner and 2,000+ other apps remarkably fast.

Trigger workflow on

HTTP requests, schedules and app events

Next, do this

Verify Webhook with the Shopify Partner API

No credit card required

▶

Watch us build a workflow

8 min

Watch now ➜

Trusted by 800,000+ developers from startups to Fortune 500 companies

Developers ♥ Pipedream

Getting Started#

Create a workflow to Verify Webhook with the Shopify Partner API. When you configure and deploy the workflow, it will run on Pipedream's servers 24x7 for free.

Configure the Verify Webhook action
1. Connect your Shopify Partner account
2. Configure App API secret key
3. Configure Shopify HMAC Signature
4. Configure Webhook Body
Select a trigger to run your workflow on HTTP requests, schedules or app events
Deploy the workflow
Send a test event to validate your setup
Turn on the trigger

Integrations#

Verify Webhook with Shopify Partner API on New Requests (Payload Only) from HTTP / Webhook API

HTTP / Webhook + Shopify Partner

Try it

Verify Webhook with Shopify Partner API on New Item in Feed from RSS API

RSS + Shopify Partner

Try it

Verify Webhook with Shopify Partner API on New Message in Channel from Discord Bot API

Discord Bot + Shopify Partner

Try it

Verify Webhook with Shopify Partner API on New Submission from Typeform API

Typeform + Shopify Partner

Try it

Verify Webhook with Shopify Partner API on Custom Events from Zoom API

Zoom + Shopify Partner

Try it

Details#

This is a pre-built, source-available component from Pipedream's GitHub repo. The component is developed by Pipedream and the community, and verified and maintained by Pipedream.

To contribute an update to an existing component or create a new component, create a PR on GitHub. If you're new to Pipedream component development, you can start with quickstarts for trigger span and action development, and then review the component API reference.

Verify Webhook on Shopify Partner

Description:Verify an incoming webhook from Shopify. Exits the workflow if the signature is not valid, otherwise returns `true`

Version:0.0.4

Key:shopify_partner-verify-webhook

View on GitHub

Code#

import shopify_partner from "../../shopify_partner.app.mjs";
import crypto from "crypto";

export default {
  name: "Verify Webhook",
  version: "0.0.4",
  key: "shopify_partner-verify-webhook",
  description:
    "Verify an incoming webhook from Shopify. Exits the workflow if the signature is not valid, otherwise returns `true`",
  props: {
    shopify_partner,
    appSecretKey: {
      type: "string",
      secret: true,
      label: "App API secret key",
      description:
        "The secret key associated with the Shopify App receiving the webhook.",
    },
    shopifyHmac: {
      type: "string",
      label: "Shopify HMAC Signature",
      description:
        "The value of the `x-shopify-hmac-sha256` webhook request header. Use `{{steps.trigger.event.headers['x-shopify-hmac-sha256']}}` to reference the header from the HTTP trigger",
    },
    body: {
      type: "any",
      label: "Webhook Body",
      description:
        "The incoming webhook payload. Use `{{ steps.trigger.event.body }}` to reference the request body from the HTTP trigger.",
    },
  },
  type: "action",
  methods: {},
  async run({ $ }) {
    // Webhook documentation on shape, etc.
    // https://shopify.dev/apps/webhooks/configuration/mandatory-webhooks
    const body = this.body;
    const shopifyHmac = this.shopifyHmac;

    // verify webhook origin
    const hash = crypto
      .createHmac("sha256", this.appSecretKey)
      .update(Buffer.from(JSON.stringify(body)))
      .digest("base64");

    if (hash !== shopifyHmac) {
      console.log("Invalid webhook signature, unauthorized");
      console.log(shopifyHmac, hash);
      return $.flow.exit("Invalid webhook signature.");
    }

    return true;
  },
};

Configuration#

This component may be configured based on the props defined in the component code. Pipedream automatically prompts for input values in the UI and CLI.

Label	Prop	Type	Description
Shopify Partner	`shopify_partner`	`app`	This component uses the Shopify Partner app.
App API secret key	`appSecretKey`	`string`	The secret key associated with the Shopify App receiving the webhook.
Shopify HMAC Signature	`shopifyHmac`	`string`	The value of the `x-shopify-hmac-sha256` webhook request header. Use `{{steps.trigger.event.headers['x-shopify-hmac-sha256']}}` to reference the header from the HTTP trigger
Webhook Body	`body`	`any`	The incoming webhook payload. Use `{{ steps.trigger.event.body }}` to reference the request body from the HTTP trigger.

Authentication#

Shopify Partner uses API keys for authentication. When you connect your Shopify Partner account, Pipedream securely stores the keys so you can easily authenticate to Shopify Partner APIs in both code and no-code steps.