Webhook authentication for Shopify sources

Turn on HMAC webhook authentication for a Shopify source, choose the right signing secret, and enforce it safely.

When to use this

Use this guide to turn on webhook authentication for a source that receives webhooks from Shopify. Shopify signs every webhook it sends with an HMAC signature, so HC can check that each request really came from your store and was not changed on the way.

For how webhook authentication works in general, and the other methods, see Securing a webhook-triggered stream.

Before you start

Find out how the Shopify webhooks reaching this source were created, because that decides which secret Shopify signs them with.

How the webhook was created	Signed with	Signing Secret from
Subscribed by the HighCohesion app (the usual case)	The app's secret, already held in the source's key	This Source's Key
Created by hand in Shopify admin (Settings > Notifications > Webhooks), including the Send test notification button	The store's own webhook key	Type it in: copy the value after "Your webhooks will be signed with" on that Shopify page

If one source receives both kinds, they are signed with different secrets and one kind will fail. Keep app-subscribed and hand-made webhooks on separate sources.

Steps

Set it up in audit mode

Open the stream and, under Source, click Edit.
Scroll to Webhook authentication and set Auth mode to HMAC (the sender signs the body). Because the source's system is Shopify, the form fills in the rest: Signature header X-Shopify-Hmac-Sha256, Algorithm sha256, Encoding base64, no Signature prefix.
Set Signing Secret from using the table above. If you choose Type it in, paste the store's webhook key into Signing Secret.
Leave Enforce unticked and click Update Source.

Enforce once every request passes

Wait for real webhooks to arrive. A day of normal traffic is usually enough.
Edit the source again and tick Enforce. Before it saves, the form shows the Auth Results for the last 7 days for each stream using the source, split into Pass, Fail and Missing.
Confirm only if every request shows Pass. Any Fail or Missing would have been rejected; fix the cause first (see below).

What you should see

In audit mode, webhooks keep arriving as before and each one gets an Auth Result. Once enforced, requests that fail the check are turned away. Rejected requests are lost: they create no event or job and HC cannot retry them. Shopify may retry for a while, and can remove a webhook subscription after repeated failures.

Keeping it working

With This Source's Key, the secret stays in step with the key. Update the key's secret and every source using it picks up the new value at once.
Reinstalling the Shopify app, or rotating its secret, changes what Shopify signs with. Update the key at the same time, or enforced sources will start rejecting webhooks. If you cannot change both at once, untick Enforce first and enforce again once the Auth Results show Pass.
Changes saved while Enforce is ticked take effect immediately. To change a setting on an enforced source, untick Enforce, save the change, check the results, then enforce again.

If it did not work

Every request shows Fail. The secret is probably the wrong one. Check how the webhooks were created and pick the matching Signing Secret from option in the table above.

Some requests pass and some fail. The source is receiving both app-subscribed and hand-made webhooks. Move one kind to a separate source.

Requests passed, then suddenly fail. The app was reinstalled or its secret changed. Untick Enforce if it is on, update the key, and check the results before enforcing again.

An enforced source has stopped receiving data. Untick Enforce first to stop further losses, then investigate. Ask Shopify to resend anything rejected in the meantime, if it can.

Was this helpful?

Still need help? Ask the team