> ## Documentation Index
> Fetch the complete documentation index at: https://bobprince-78964c2b.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# Shopify

> Capture and inspect Shopify webhook events with Hookdrop.

Use Hookdrop as your Shopify webhook URL to capture order, product, customer, and fulfilment events — and inspect every payload without running a public server.

## Setup

<Steps>
  <Step title="Open notification settings">
    In your Shopify admin, go to **Settings → Notifications**, then scroll down to **Webhooks**.
  </Step>

  <Step title="Create a webhook">
    Click **Create webhook**.
  </Step>

  <Step title="Select an event">
    Choose the event you want to capture from the **Event** dropdown (for example, `Order creation`).
  </Step>

  <Step title="Paste your Hookdrop URL">
    Enter your capture URL in the **URL** field:

    ```
    https://hookdrop.dev/in/{your-token}
    ```

    Replace `{your-token}` with the token shown on your Hookdrop dashboard.
  </Step>

  <Step title="Set the format">
    Set **Format** to **JSON**.
  </Step>

  <Step title="Save">
    Click **Save**. Shopify sends a verification request — Hookdrop handles it automatically, and the webhook is confirmed.
  </Step>
</Steps>

<Note>
  Shopify requires you to create one webhook per event type. Repeat the steps above for each event you want to capture.
</Note>

## Common events

| Event                 | When it fires              |
| --------------------- | -------------------------- |
| `orders/create`       | A new order is placed      |
| `orders/paid`         | An order payment completes |
| `fulfillments/create` | An order is fulfilled      |
| `products/create`     | A new product is created   |
| `customers/create`    | A new customer registers   |

## Signature verification

Shopify signs every webhook request with an `X-Shopify-Hmac-SHA256` header containing a Base64-encoded HMAC SHA-256 digest. Verify it in your handler before processing any event.

```typescript shopify-webhook.ts theme={null}
import crypto from 'crypto'

const verifyShopifyWebhook = (
  payload: string,
  signature: string,
  secret: string
): boolean => {
  const expected = crypto
    .createHmac('sha256', secret)
    .update(payload)
    .digest('base64')

  return crypto.timingSafeEqual(
    Buffer.from(expected),
    Buffer.from(signature)
  )
}
```

Find your webhook secret in **Shopify admin → Settings → Notifications → Webhooks**. Each webhook shares the same secret for your store.

<Warning>
  The `X-Shopify-Hmac-SHA256` value is Base64-encoded, not hex. Make sure you call `.digest('base64')` — not `.digest('hex')` — when computing the expected signature.
</Warning>

## Testing locally

<Tip>
  Use your Hookdrop URL when building Shopify integrations locally. Captured events are stored in your dashboard, so you can replay an `orders/create` payload to your handler as many times as needed — without placing a real test order each time.
</Tip>

<Card title="Next: Paystack" icon="credit-card" href="/integrations/paystack">
  Set up Hookdrop to capture Paystack payment and subscription events.
</Card>