Webhook Guides

Shopify Webhook Test

A useful Shopify webhook test checks more than whether the endpoint is online. It should confirm topic routing, HMAC verification, duplicate delivery handling, destination status, retry behavior, and replay safety.

FastHook gives Shopify a stable source URL, stores request headers and payloads, routes by topic, records delivery attempts, and lets you retry failed events after the receiver is fixed.

Headers to verify

HeaderTest purpose
X-Shopify-TopicConfirm the event family, such as orders/create or products/update.
X-Shopify-Shop-DomainSeparate traffic by merchant store.
X-Shopify-Hmac-SHA256Verify the raw body with the Shopify app secret.
X-Shopify-Webhook-IdDeduplicate a specific delivery.
X-Shopify-Event-IdCorrelate retries for the same merchant action.

Send a representative order payload

Use real Shopify test deliveries when validating HMAC. The cURL payload below is useful for route and receiver behavior, but it does not create a valid Shopify HMAC by itself.

Shopify order test
curl -X POST "https://hook-xxxxxx.fasthook.io/" \
  -H "Content-Type: application/json" \
  -H "X-Shopify-Topic: orders/create" \
  -H "X-Shopify-Shop-Domain: cool-store.myshopify.com" \
  -d '{
    "id": 549755813,
    "name": "#1001",
    "email": "customer@example.com",
    "currency": "USD",
    "total_price": "49.00",
    "financial_status": "paid"
  }'

Route Shopify topics

Topic filter
{
  "type": "filter",
  "headers": {
    "x-shopify-topic": {
      "$in": ["orders/create", "orders/paid", "orders/fulfilled"]
    }
  }
}

Test checklist

  1. Confirm the request appears with Shopify headers and payload.
  2. Confirm HMAC verification succeeds when using real Shopify delivery.
  3. Confirm the topic filter creates exactly the intended destination event.
  4. Force a destination 500 and confirm retry behavior.
  5. Send or replay the same event twice and confirm receiver idempotency.

Debugging failures

  • A missing topic header usually means the test request is not representative.
  • An HMAC mismatch usually means the wrong app secret or mutated raw body.
  • A duplicate order side effect means the receiver is not using webhook id or event id safely.
  • A failed destination attempt should be retried only after the receiver is fixed.

Replay safety for commerce events

Shopify events often trigger fulfillment, refunds, customer messages, inventory updates, or order notes. Before replaying a failed delivery, confirm the receiver can see whether the order side effect already happened.

The safest handler stores Shopify delivery identifiers and the business object id before applying side effects. That way a provider retry, a FastHook retry, or an operator replay can be accepted without shipping the same order twice.

  • Use X-Shopify-Webhook-Id for delivery deduplication.
  • Use order id, fulfillment id, or product id as the business idempotency key.
  • Replay into staging before replaying production order windows.
  • Throttle replay when the receiver calls Shopify APIs or warehouse systems.

Related guides