Shopify Webhook HMAC-SHA256 Verifier (`X-Shopify-Hmac-Sha256` Base64)
Compute and verify Base64-encoded X-Shopify-Hmac-Sha256 webhook signatures for Shopify orders/create and GDPR webhooks in browser.
Verify Received X-Shopify-Hmac-Sha256 Header
How do I use Shopify Webhook HMAC-SHA256 Verifier (`X-Shopify-Hmac-Sha256` Base64)?
Notice the tool is pre-configured to 'Shopify (Base64)' mode with `SHA-256`, `BASE64` output encoding, and a sample Shopify `orders/create` payload.
Enter your Shopify App Client Secret (or Admin Webhook Signing Secret starting with `shpss_...`).
Paste the raw HTTP webhook JSON body to compute the exact Base64 `X-Shopify-Hmac-Sha256` header.
Paste a received `X-Shopify-Hmac-Sha256` header value into the bottom verifier field to confirm authenticity.
What features does Shopify Webhook HMAC-SHA256 Verifier (`X-Shopify-Hmac-Sha256` Base64) offer?
Pre-configured for Shopify's mandatory **Base64** HMAC-SHA256 output encoding (`X-Shopify-Hmac-Sha256`)
Pre-loaded with a Shopify `orders/create` webhook payload and `shpss_` signing secret
Eliminates the #1 Shopify webhook bug (comparing Shopify's Base64 header against a Hex digest)
Case-sensitive Base64 signature verification matching Shopify App Store review requirements
Ideal for testing mandatory GDPR webhooks (`customers/data_request`, `customers/redact`, `shop/redact`)
100% Client-Side Web Crypto API: your Shopify App Client Secret never leaves your browser
Shopify `X-Shopify-Hmac-Sha256` Base64 Signature Specification
While Stripe and GitHub encode HMAC-SHA256 signatures in lowercase hexadecimal, Shopify encodes `X-Shopify-Hmac-Sha256` in **Base64**.
X-Shopify-Hmac-Sha256 = Base64(HMAC_SHA256(client_secret, raw_utf8_body))In Node.js: `crypto.createHmac('sha256', secret).update(rawBody, 'utf8').digest('base64')`.
| Shopify HTTP Header | Example Value | Purpose | Verification Gotcha |
|---|---|---|---|
| X-Shopify-Hmac-Sha256 | XW8nK9pL2mQ4vR7sT0uV...= | Base64 HMAC-SHA256 of raw body | Must use .digest('base64'), NEVER .digest('hex') |
| X-Shopify-Topic | orders/create | Identifies webhook event type | Route handler dispatch key |
| X-Shopify-Shop-Domain | joytools-demo.myshopify.com | Originating merchant store | Validate against installed shop record |
| X-Shopify-Webhook-Id | b54557e4-4910-420a-8c3e... | Unique delivery UUID | Use as Redis idempotency key for retries |
How is Shopify Webhook HMAC-SHA256 Verifier (`X-Shopify-Hmac-Sha256` Base64) used in real-world workflows?
Passing Automated Shopify App Store GDPR Webhook Audits
Shopify's automated App Store review bot sends test requests with valid and invalid `X-Shopify-Hmac-Sha256` headers—verify that your endpoint returns `200 OK` on valid Base64 signatures and `401 Unauthorized` on invalid ones.
Debugging Custom Admin Webhook Secret (`shpss_`) Signatures
Webhooks created inside `Shopify Admin > Settings > Notifications` use the store's `shpss_...` signing secret rather than a Partner App Client Secret—test both here.
Simulating `orders/paid` and `inventory_levels/update` in Postman
Generate valid Base64 `X-Shopify-Hmac-Sha256` headers for modified test order payloads before firing them at your local tunnel.
Frequently Asked Questions about Shopify Webhook HMAC-SHA256 Verifier (`X-Shopify-Hmac-Sha256` Base64)
Why does my Shopify HMAC signature never match when I use `.digest('hex')`?
Because Shopify encodes the `X-Shopify-Hmac-Sha256` header in **Base64** (44 characters ending in `=`), whereas `.digest('hex')` outputs a 64-character hexadecimal string. That is why this tool pre-selects `BASE64` encoding automatically.
Which secret does Shopify use to sign webhooks?
If the webhook was registered via a Shopify Partner App (GraphQL `webhookSubscriptionCreate` or `shopify.app.toml`), it is signed with your App's **Client Secret**. If the webhook was created manually inside a store's `Settings > Notifications > Webhooks`, it is signed with the store's `shpss_...` webhook signing secret shown at the bottom of that page.
How does Shopify handle floating-point numbers and Unicode in the raw body?
Always verify the HMAC against the raw UTF-8 request buffer (`req.rawBody` or `await request.text()`) before parsing JSON. Parsing JSON in JavaScript turns `149.50` into `149.5`, which changes the byte stream and invalidates the HMAC.
Is my Shopify Client Secret safe in this tool?
Yes. Signatures are computed 100% locally in your browser using the native Web Crypto API.
Explore Related Developer Tools
Stripe Webhook Signature Verifier
Generate and verify Stripe Stripe-Signature (t=timestamp,v1=hex) HMAC-SHA256 webhook headers over ${timestamp}.${raw_body} in browser.
GitHub Webhook Signature Tester
Compute and verify GitHub X-Hub-Signature-256 (sha256=<hex>) HMAC-SHA256 webhook headers for push and pull_request events.
HMAC Signature Generator
Generate and verify HMAC signatures (HMAC-SHA256, HMAC-SHA512) for Stripe, GitHub, Shopify, and Webhook verification.
Bcrypt & Argon2 Password Hash Generator & Verifier
Generate cryptographically secure Bcrypt password hashes ($2b$) with custom cost rounds, or test password verification.
JWT Decoder
Decode and inspect JSON Web Tokens. View header, payload, signature, and expiration status.
Hash Generator
Generate MD5, SHA-1, SHA-256, and SHA-512 cryptographic hash digests from text or files.