Shopify

Capture and inspect Shopify webhook events with Hookdrop.

Use Hookdrop as your Shopify webhook URL to capture order, product, customer, and fulfilment events — and inspect every payload without running a public server.

Setup

1. Open notification settings

   In your Shopify admin, go to Settings → Notifications, then scroll down to Webhooks.

2. Create a webhook

   Click Create webhook.

3. Select an event

   Choose the event you want to capture from the Event dropdown (for example, Order creation).

4. Paste your Hookdrop URL

   Enter your capture URL in the URL field:

   https://hookdrop.dev/in/{your-token}
   

   Replace {your-token} with the token shown on your Hookdrop dashboard.

5. Set the format

   Set Format to JSON.

6. Save

   Click Save. Shopify sends a verification request — Hookdrop handles it automatically, and the webhook is confirmed.

Shopify requires you to create one webhook per event type. Repeat the steps above for each event you want to capture.

Common events

Event	When it fires
orders/create	A new order is placed
orders/paid	An order payment completes
fulfillments/create	An order is fulfilled
products/create	A new product is created
customers/create	A new customer registers

Signature verification

Shopify signs every webhook request with an X-Shopify-Hmac-SHA256 header containing a Base64-encoded HMAC SHA-256 digest. Verify it in your handler before processing any event.

shopify-webhook.ts

import crypto from 'crypto'

const verifyShopifyWebhook = (
  payload: string,
  signature: string,
  secret: string
): boolean => {
  const expected = crypto
    .createHmac('sha256', secret)
    .update(payload)
    .digest('base64')

  return crypto.timingSafeEqual(
    Buffer.from(expected),
    Buffer.from(signature)
  )
}

Find your webhook secret in Shopify admin → Settings → Notifications → Webhooks. Each webhook shares the same secret for your store.

The X-Shopify-Hmac-SHA256 value is Base64-encoded, not hex. Make sure you call .digest('base64') — not .digest('hex') — when computing the expected signature.

Testing locally

Use your Hookdrop URL when building Shopify integrations locally. Captured events are stored in your dashboard, so you can replay an orders/create payload to your handler as many times as needed — without placing a real test order each time.

Next: Paystack

Set up Hookdrop to capture Paystack payment and subscription events.