Shopify Webhooks

Handles Shopify webhook verification and routing for store events like orders, products, and customers. The skill nails the tricky part: HMAC-SHA256 signature verification using base64 encoding (not hex like some other providers), with timing-safe comparison code in both Node and Python. Shopify requires a 200 response within 5 seconds, so you'll need async processing for anything heavy. Includes reference docs and complete Express, Next.js, and FastAPI examples. Built by Hookdeck, who clearly deal with webhooks all day. Pairs well with their webhook-handler-patterns skill for idempotency and retry logic, which matters more than you think when processing payment events.

skills.sh installs: 289
GitHub stars: 100
last updated: Aug 21, 2026

View on GitHub

Install

$ npx -y skills add hookdeck/webhook-skills --skill shopify-webhooks --agent claude-code

Installs into .claude/skills of the current project.

Files

Shopify Webhooks

When to Use This Skill

Setting up Shopify webhook handlers
Debugging signature verification failures
Understanding Shopify event types and payloads
Handling order, product, or customer events

Verification (core)

Shopify signs the raw body with HMAC-SHA256 keyed on the app's API secret and sends the digest in X-Shopify-Hmac-SHA256 as base64 (not hex). Pass the raw body, decode base64, and compare timing-safe. The topic is in X-Shopify-Topic; the shop domain in X-Shopify-Shop-Domain.

Node:

const crypto = require('crypto');

function verify(rawBody, hmacHeader, secret) {
  if (!hmacHeader) return false;
  const expected = crypto.createHmac('sha256', secret).update(rawBody).digest('base64');
  try {
    return crypto.timingSafeEqual(Buffer.from(hmacHeader), Buffer.from(expected));
  } catch {
    return false;
  }
}

Python: