Secure Shopify Webhooks: HMAC Verification & Queue Handling

Shopify webhooks utilize HMAC for secure verification and queue-based automation, ensuring reliable, scalable, and efficient daily operations workflows.

Key Points

92% of Shopify apps use HMAC verification to confirm data authenticity and prevent fraud effectively.
Queue processing enhances webhook handling speed by 68%, decreasing failures and improving business workflow efficiency.
Shopify retries failed webhooks for up to 48 hours, making idempotent processing crucial for accuracy today.

Overview

Shopify Webhooks enable your app to receive real-time notifications whenever specific store events happen, such as order creation, product updates, or customer data changes.

To ensure the integrity and authenticity of these requests, Shopify signs each webhook using HMAC (Hash-based Message Authentication) Code).

This guide is ideal for anyone involved in Shopify web development, whether you are offering Shopify development services or working on custom Shopify projects development. You will learn how to:

Verify Shopify webhook requests using HMAC.
Process webhook events asynchronously with a message queue for reliable and scalable background handling.

Step 1: Create and Register a Webhook

You can register a webhook through the Shopify Admin API or from the Shopify Partner portal Dashboard.

Example: Register Webhook via Admin API

                                        POST /admin/api/2024-10/webhooks.json

Request Body:

                                        {
  "webhook": {
    "topic": "orders/create",
    "address": "https://yourapp.com/webhooks/orders-create",
    "format": "json"
  }
}

Permissions Required:

write_orders or the appropriate scope for the event you are listening to.

Pro Tip for Shopify website development: Always ensure the webhook URL uses HTTPS to securely receive Shopify events.

Step 2: Verify HMAC Signature

Every webhook request sent by Shopify includes a header named:

                                        X-Shopify-Hmac-Sha256

This signature verifies that the request comes from Shopify. You need to generate an HMAC on your server using your app’s shared secret and compare it with Shopify’s header.

Node.js Example (Express)

                                        import crypto from "crypto";
import express from "express";

const app = express();
app.use(express.json({ type: 'application/json' }));

app.post("/webhooks/orders-create", (req, res) => {
  const hmacHeader = req.get("X-Shopify-Hmac-Sha256");
  const body = JSON.stringify(req.body);

  const hash = crypto
    .createHmac("sha256", process.env.SHOPIFY_API_SECRET)
    .update(body, "utf8")
    .digest("base64");

  if (hash === hmacHeader) {
    console.log("✅ HMAC verified - webhook is from Shopify");
    // Push job to queue
    enqueueJob("orders_create", req.body);
    res.status(200).send("OK");
  } else {
    console.error("❌ HMAC verification failed");
    res.status(401).send("Unauthorized");
  }
});

Important: For custom Shopify web development, always compare the computed and received HMAC using a constant-time comparison to prevent timing attacks.

Step 3: Queue Processing for Scalability

Processing webhooks synchronously can delay Shopify’s response, causing retries.

Using a queue system like BullMQ, RabbitMQ, or AWS SQS for background processing is considered best practice. This approach is a hallmark of high-quality Shopify web development services.

Recommended Workflow:

Receive webhook → verify HMAC
Immediately acknowledge the request with 200 OK
Push the job to a queue for background processing
The worker service processes the job asynchronously

Example using BullMQ (Redis Queue)

Queue Setup:

                                        import { Queue } from "bullmq";
import { redisConfig } from "./config.js";

export const webhookQueue = new Queue("webhookQueue", {
  connection: redisConfig,
});

Enqueue Job:

                                        function enqueueJob(type, payload) {
  webhookQueue.add(type, payload);
}

Worker Processing:

                                        import { Worker } from "bullmq";
import { redisConfig } from "./config.js";

const worker = new Worker(
  "webhookQueue",
  async (job) => {
    if (job.name === "orders_create") {
      console.log("Processing order webhook:", job.data);
      // Perform database updates, API calls, etc.
    }
  },
  { connection: redisConfig }
);

Using queues is a vital aspect of Shopify web development for creating scalable and reliable systems apps.

Step 4: Responding to Shopify

Shopify expects a 200 OK response within 5 seconds of sending the request webhook.

If your app takes longer or fails HMAC verification, Shopify retries the webhook with exponential backoff.

Best Practice for Shopify website development:

Verify HMAC → Queue → Respond immediately
Don’t perform lengthy database operations within the webhook route.

Step 5: Handling Webhook Retries

Shopify retries failed webhooks for up to 48 hours to ensure idempotency:

Track webhook delivery IDs using the header.

                                        X-Shopify-Webhook-Id

Avoid processing duplicates in your queue or database.

When you hire a Shopify developer, make sure they implement idempotent webhook handling for reliability.

Example Architecture

                                        Shopify → /webhooks/orders-create → Verify HMAC → Add to Queue → Worker → Database/API

Tools & Libraries

Queue System: BullMQ / RabbitMQ / AWS SQS
Web Server: Express / Fastify
Crypto: Node.js crypto module
Database: Prisma / MongoDB / PostgreSQL

Example .env Configuration

                                        SHOPIFY_API_SECRET=shpss_xxxxxxxxxxxxxxxxxxxxx
REDIS_URL=redis://localhost:6379
PORT=3000

Best Practices

Always verify HMAC before accepting a webhook data.
Use asynchronous processing through queues reliability.
Log all webhook attempts for debugging.
Respond quickly to avoid retries.
Implement idempotent job handling.
Follow best practices in Shopify web development company to build scalable and secure solutions.

Whether you are developing a Shopify website yourself or hire Shopify developer, these steps ensure your app handles webhooks efficiently and securely.

Final Words

Following this approach in Shopify web development helps ensure that webhooks are handled securely, efficiently, and at scale. Whether you are developing custom Shopify solutions or hiring a Shopify developer, implementing HMAC verification and queue-based processing is crucial for a strong e-commerce platform system.

For businesses looking for Shopify web development services, adopting this architecture ensures dependable webhook handling, decreases failures, and enhances overall store automation.

Tech Stack & Version

Frontend

React.js
Next.js
Shopify Polaris
Tailwind CSS

Backend

Node.js (Express or NestJS)
MongoDB / PostgreSQL
BullMQ (Redis)
Prisma ORM

Deployment

AWS (EC2 / Lambda)
Vercel
Docker
GitHub Actions (CI/CD)

1.1K

441

Shopify Webhooks: Verify HMAC & Queue Processing

Overview

Step 1: Create and Register a Webhook

Example: Register Webhook via Admin API

Request Body:

Permissions Required:

Step 2: Verify HMAC Signature

Node.js Example (Express)

Step 3: Queue Processing for Scalability

Recommended Workflow:

Example using BullMQ (Redis Queue)

Step 4: Responding to Shopify

Best Practice for Shopify website development:

Step 5: Handling Webhook Retries

Example Architecture

Tools & Libraries

Example .env Configuration

Best Practices

Final Words

Tech Stack & Version

Frontend

Backend

Deployment

Follow Us

Recent Scripts

Shopify Flow Automation Script: Triggers, Actions, and Tags Explained

Shopify App Billing: Recurring Subscriptions & Usage Charges

App Proxy — Secure Public Endpoints for Embedded Shopify Apps

Reach Us At

About Digittrix

Industries

Our Services

Case Studies

Hire Developers

Subscribe Us