How to Test Shopify Webhooks

{
  "id": 820982911946154500,
  "email": "jon@example.com",
  "total_price": "199.00",
  "currency": "USD",
  "financial_status": "paid",
  "fulfillment_status": null,
  "line_items": [
    {
      "title": "Premium Widget",
      "quantity": 2,
      "price": "99.50"
    }
  ]
}

import crypto from 'node:crypto';
import express from 'express';

const app = express();

app.post(
  '/webhooks/shopify',
  express.raw({ type: 'application/json' }),
  (req, res) => {
    const hmacHeader = req.headers['x-shopify-hmac-sha256'] as string | undefined;
    if (!hmacHeader) return res.status(401).send('missing hmac');

    const calculated = crypto
      .createHmac('sha256', process.env.SHOPIFY_API_SECRET!)
      .update(req.body) // raw Buffer
      .digest('base64'); // NOTE: base64, NOT hex

    if (
      hmacHeader.length !== calculated.length ||
      !crypto.timingSafeEqual(
        Buffer.from(hmacHeader),
        Buffer.from(calculated),
      )
    ) {
      return res.status(401).send('invalid hmac');
    }

    const event = JSON.parse(req.body.toString('utf8'));
    res.json({ ok: true, topic: req.headers['x-shopify-topic'], id: event.id });
  },
);

import hmac, hashlib, base64, os
from fastapi import FastAPI, Request, HTTPException

app = FastAPI()

@app.post("/webhooks/shopify")
async def shopify_webhook(request: Request):
    body = await request.body()
    hmac_header = request.headers.get('x-shopify-hmac-sha256', '')
    calculated = base64.b64encode(
        hmac.new(
            os.environ['SHOPIFY_API_SECRET'].encode(),
            msg=body,
            digestmod=hashlib.sha256,
        ).digest()
    ).decode()
    if not hmac.compare_digest(hmac_header, calculated):
        raise HTTPException(status_code=401, detail='invalid hmac')
    topic = request.headers.get('x-shopify-topic')
    return {'ok': True, 'topic': topic}