Source type

Shopify Source Configuration

Shopify sources receive shop, order, product, fulfillment, inventory, customer, and app lifecycle webhooks with Shopify HMAC verification.

SHOPIFYPOST, PUT, PATCH, DELETEWebhook Signing SecretCommerce
Shopify webhooks documentationShopify webhook gatewayAll source types
Shopify sends webhook traffic to a FastHook source, FastHook validates the provider contract, records the request, and routes accepted events through connections to destinations.ShopifyProviderPOST, PUT, PATCH, DELETESignedFastHookSource URLSHOPIFYProvider credentialsignatureVerify before queue401 on auth failure405 on wrong methodAcceptedRequestverified: trueConnections route the accepted request to destinationsFilters, transformations, retries, replay, and destination signatures stay downstream from source verification.

Shopify configuration

Create a Shopify source, keep POST and PUT and PATCH and DELETE enabled, and provide the configured Webhook Signing Secret values for provider signature. FastHook uses these settings to validate each Shopify delivery before it enters the routing workflow.

Source Type

SHOPIFY

Allowed methods

POST, PUT, PATCH, DELETE

Authentication

Provider signature

Credential fields

Webhook Signing Secret

Shopify source config
{
  "type": "SHOPIFY",
  "config": {
    "auth_type": "PROVIDER_SIGNATURE",
    "auth": {
      "provider": "SHOPIFY",
      "webhook_signing_secret": "provider-secret"
    },
    "allowed_http_methods": ["POST","PUT","PATCH","DELETE"]
  }
}

Shopify request contract

FastHook computes a base64 HMAC-SHA256 digest over the raw request body and compares it to x-shopify-hmac-sha256.

POSTPUTPATCHDELETE

Shopify headers

Preserve x-shopify-hmac-sha256, x-shopify-topic, x-shopify-webhook-id when sending Shopify test deliveries. FastHook evaluates this request context before accepting the payload, so missing or modified values remain visible as rejected requests instead of routed events.

x-shopify-hmac-sha256

Base64 HMAC-SHA256 signature over the raw request body.

x-shopify-topic

Shopify topic such as orders/create or products/update.

x-shopify-webhook-id

Delivery identifier for deduplication and debugging.

Shopify setup

  1. Register the FastHook Source URL as the delivery URL for the Shopify webhook subscription.
  2. Use the same signing material your Shopify app uses to verify webhook deliveries.
  3. Route by x-shopify-topic or body fields when different commerce events should reach different destinations.

Shopify routing hints

  • Order, customer, product, fulfillment, inventory, and app lifecycle events usually route by x-shopify-topic.
  • Use x-shopify-webhook-id or the Shopify object id when receivers need duplicate protection.

Continue with Shopify