shopify-webhooks

Compute an HMAC-SHA256 digest of the raw request body using your app secret, encode it as base64, and compare it to the X-Shopify-Hmac-SHA256 header with crypto.timingSafeEqual. Always pass the body as a Buffer and wrap the comparison in try/catch.

Call the webhookSubscriptionCreate mutation with a topic and callbackUrl for each event, ideally inside the afterAuth hook so subscriptions are recreated after reinstall. Treat the 'Address for this topic has already been taken' userError as non-fatal.

Verification fails when the body is parsed as JSON before the HMAC check, because re-serialization changes the byte representation. Mount express.raw({ type: 'application/json' }) on webhook routes before any JSON body parser.

Shopify requires three endpoints: customers/data_request, customers/redact, and shop/redact. Each must respond with HTTP 200 within the timeout even if your app stores no personal data, or the app will fail review.

Use the X-Shopify-Webhook-Id header as an idempotency key: record processed IDs in a database and skip repeats, and pass the webhook ID as the BullMQ jobId so duplicate queue entries are rejected. Shopify retries up to 19 times over 48 hours.

Shopify flags deliveries that return non-2xx status or take longer than 5 seconds. Respond 200 immediately in the HTTP handler and offload heavy work like ERP syncs to a background queue with retries and exponential backoff.