Shopify

Test a Shopify webhook locally

Building a Shopify app means handling its webhooks (orders, products) — without creating real orders on every test. Generate a Shopify event signed (X-Shopify-Hmac-Sha256, base64), edit the payload and send it to your local server to validate your HMAC verification.

EventPayload (editable)API secret keyApp's shared secretTarget URL (optional — to send)your local handler via Relay, or a Receiver URL🔒 Shopify is a Pro-only feature — Unlock

Generate the signature to see the headers, the body and a ready-to-paste cURL command.

Verify the signature server-side

handler.js (Node)

import crypto from 'crypto';
const hmac = req.headers['x-shopify-hmac-sha256'];
const digest = crypto
  .createHmac('sha256', process.env.SHOPIFY_SECRET)
  .update(rawBody, 'utf8')
  .digest('base64');
const ok = crypto.timingSafeEqual(Buffer.from(hmac), Buffer.from(digest));

To receive a real Shopify webhook locally, register the URL of your Relay tunnel in your Shopify app.

Frequently asked questions

How do I simulate a Shopify order locally?

Pick the orders/create event, paste your app secret key, enter your local handler's URL (via Relay) and send. The X-Shopify-Hmac-Sha256 header is computed with HMAC-SHA256 encoded in base64, exactly like Shopify.

Is the Shopify HMAC in hex or base64?

In base64, unlike Stripe or GitHub which use hexadecimal. The generator produces the right encoding automatically.

Which events are available?

orders/create and products/update are provided, with the matching X-Shopify-Topic header. You can freely edit the JSON payload.

Is Shopify free?

Shopify is one of the premium presets, available with the Pro plan at €14.90/month.