Receiving Shopify Webhooks: Configuration & Security Guide

import express from "express";
import crypto from "crypto";

const app = express();
const secret = process.env.SHOPIFY_WEBHOOK_SECRET ?? "";

app.post(
  "/webhooks",
  express.text({ type: "*/*" }),
  async (req, res) => {
    const hmacHeader = req.get("X-Shopify-Hmac-Sha256") ?? "";
    const digest = crypto
      .createHmac("sha256", secret)
      .update(req.body, "utf8")
      .digest("base64");

    if (!crypto.timingSafeEqual(Buffer.from(digest), Buffer.from(hmacHeader))) {
      return res.status(401).send("Unauthorized");
    }

    res.status(200).send("OK");

    const topic = req.get("X-Shopify-Topic");
    const shop = req.get("X-Shopify-Shop-Domain");
    const payload = JSON.parse(req.body);
    await enqueueWebhook({ topic, shop, payload });
  },
);

async function enqueueWebhook(event: {
  topic: string | null;
  shop: string | null;
  payload: unknown;
}) {
  // Push onto a queue (BullMQ, SQS, Cloud Tasks, etc.) for async processing
}

app.listen(3000, () => console.log("Webhook server listening on port 3000"));

// Using @shopify/shopify-app-express to validate requests
import { shopifyApp } from "@shopify/shopify-app-express";

const shopify = shopifyApp({
  api: {
    apiKey: process.env.SHOPIFY_API_KEY!,
    apiSecretKey: process.env.SHOPIFY_API_SECRET!,
  },
});

app.post(
  "/webhooks",
  express.text({ type: "*/*" }),
  async (req, res) => {
    const { valid, topic, domain } = await shopify.webhooks.validate({
      rawBody: req.body,
      rawRequest: req,
      rawResponse: res,
    });

    if (!valid) {
      return res.status(400).send("Bad Request");
    }

    res.status(200).send("OK");
    await enqueueWebhook({ topic, shop: domain, payload: JSON.parse(req.body) });
  },
);

[[webhooks.subscriptions]]
topics = ["products/update"]
uri = "https://your-backend-service.com/webhooks"
filter = "status:active AND variants.price:>=100"

import { createHmac, timingSafeEqual } from "crypto";

export function verifyShopifyWebhook(rawBody: Buffer, hmacHeader: string, secret: string) {
  const digest = createHmac("sha256", secret).update(rawBody).digest("base64");
  const valid = timingSafeEqual(Buffer.from(digest), Buffer.from(hmacHeader));

  if (!valid) {
    throw new Error("Invalid Shopify signature");
  }
}

export function handleDuplicate(eventId: string, store: Set<string>) {
  if (store.has(eventId)) {
    return false;
  }

  store.add(eventId);
  return true;
}