Shopify Integration

Prerequisites

• A HookWatch account
• A Shopify store with admin access or a Shopify Partner account
• A server endpoint to process webhook payloads

Step 1: Create a HookWatch endpoint

1. Go to your Endpoints page
2. Click "Create Endpoint"
3. Enter a name like "Shopify Webhooks"
4. Enter your destination URL (where you want webhooks forwarded)
5. Copy the generated webhook URL

Step 2: Configure Shopify webhooks

{
  "webhook": {
    "topic": "orders/create",
    "address": "{config.webhookUrl}/wh/YOUR_SLUG",
    "format": "json"
  }
}

Step 3: Verify webhooks on your server

Shopify signs webhook payloads using HMAC-SHA256. HookWatch forwards the X-Shopify-Hmac-SHA256 header so you can verify authenticity.

You'll find your webhook signing secret in Settings > Notifications > Webhooks at the bottom of the page.

const crypto = require('crypto');

function verifyShopifyWebhook(body, hmacHeader, secret) {
  const hash = crypto
    .createHmac('sha256', secret)
    .update(body, 'utf8')
    .digest('base64');
  return crypto.timingSafeEqual(Buffer.from(hash), Buffer.from(hmacHeader));
}

app.post('/webhooks/shopify', express.raw({type: 'application/json'}), (req, res) => {
  const hmac = req.headers['x-shopify-hmac-sha256'];
  const secret = process.env.SHOPIFY_WEBHOOK_SECRET;

  if (!verifyShopifyWebhook(req.body, hmac, secret)) {
    return res.status(401).send('Invalid signature');
  }

  const topic = req.headers['x-shopify-topic'];
  const payload = JSON.parse(req.body);

  switch (topic) {
    case 'orders/create':
      console.log('New order:', payload.name);
      break;
    case 'products/update':
      console.log('Product updated:', payload.title);
      break;
    // ... handle other topics
  }

  res.status(200).send('OK');
});

Shopify webhook headers

HookWatch forwards all Shopify headers. Here are the important ones:

Testing the integration

You can test Shopify webhooks by:

1. Creating a test order in your store (use Shopify's Bogus Gateway for testing)
2. Using the "Send test notification" button in webhook settings
3. Using a development store with test data