Source · Shopify · Verified November 1, 2026

Shopify

Short answer: Shopify app webhooks send topic-scoped events such as orders/create, products/update, and refunds/create.

Hooks verifies Shopify deliveries with hmac-sha256, base64 of the raw body and normalizes them into the unified event format.

Set up the webhook in Shopify

  1. Open the Shopify webhook settings in the provider console.
  2. Point the webhook at your Hooks endpoint URL (https://api.hooks.events/in/<endpoint-id>).
  3. Paste the same secret into the endpoint so Hooks can check X-Shopify-Hmac-Sha256.

Signature verification

HeaderX-Shopify-Hmac-Sha256
AlgorithmHMAC-SHA256, base64 of the raw body
Replay windowNone; dedupe by delivery id
Delivery idX-Shopify-Webhook-Id
  • HMAC-SHA256, base64 of the raw body

Events Hooks normalizes

event.typesubjectWhat it means
shopify.receivedeventShopify app webhooks send topic-scoped events such as orders/create, products/update, and refunds/create.

Normalized payload

Every adapter produces this shape before filters or templates run. The raw payload and sanitized headers stay attached for audit, but filters and templates read the normalized fields.

Normalized event

{
  "id": "evt_demo",
  "source": "shopify",
  "type": "shopify.received",
  "action": "received",
  "deliveryId": "delivery_demo",
  "subject": {
    "title": "Shopify event"
  },
  "raw": {}
}

Filter and template examples

Filter

type equals "shopify.received"

Template

"Shopify event: {{event.subject.title}}"

Retries and the delivery log

408, 425, 429, and 5xx responses retry with backoff and honor Retry-After; other 4xx responses fail permanently with a named code. Every attempt keeps the rendered request and the target response, so a failure points at one field or one status instead of a guess.

Hooks delivery detail: attempt timeline, request payload, and the destination response for one delivery
Delivery detail: the attempt timeline, the rendered request the target received, and its response — the same record an event keeps for every destination.

Common errors

SymptomFix
SIGNATURE_INVALIDUse the signing secret Shopify shows when the webhook is created, and send X-Shopify-Hmac-Sha256 for the exact raw body.
Nothing arrivesConfirm the webhook points at the endpoint's /in/<endpoint-id> URL and that the endpoint is active.

Pair with a target

Reference

Other sources

GitHubA Hooks GitHub endpoint verifies the X-Hub-Signature-256 HMAC on the raw body, stores the delivery, and normalizes each webhook into <event>.<action> (for example issues.opened) before any destination filter runs.StripeA Hooks Stripe endpoint verifies Stripe-Signature as HMAC-SHA256 over <timestamp>.<raw body> with a five-minute tolerance, then normalizes each event to <resource>.<action> such as invoice.payment_failed.SlackA Hooks Slack endpoint verifies X-Slack-Signature as HMAC-SHA256 over v0:<timestamp>:<raw body>, answers the url_verification handshake itself, and normalizes messages to app_mention.received or message.<channel_type>.LinearA Hooks Linear endpoint verifies Linear-Signature as hex HMAC-SHA256 over the raw body, rejects payloads whose webhookTimestamp is more than 60 seconds old, and normalizes events to issue.create, issue.update, and comment.create.SentryA Hooks Sentry endpoint verifies Sentry-Hook-Signature as hex HMAC-SHA256 with the Integration's Client Secret, deduplicates by Request-ID, and normalizes events to issue.created or event_alert.triggered.GitLabGitLab project webhooks cover pushes, merge requests, pipelines, issues, notes, and releases.IntercomIntercom sends conversation and contact notification topics, signed with the app client secret.ZendeskZendesk webhooks cover ticket, user, and organization events, signed with a timestamp plus body HMAC.JiraJira Cloud webhooks cover issue creation, updates, comments, and sprint changes.PagerDutyPagerDuty v3 webhooks cover incident trigger, acknowledge, resolve, and annotation events.Standard WebhooksStandard Webhooks deliveries carry webhook-id, webhook-timestamp, and base64 v1 signatures.SvixSvix Play and the Svix dispatcher use the Standard Webhooks headers with svix- prefixes.VercelVercel webhooks cover deployment, integration, project, and domain events.TwilioTwilio status callbacks cover messages, calls, and recordings, signed over the URL and form parameters.DiscordDiscord interaction webhooks use Ed25519 signatures plus a PING handshake.Generic HMACGeneric sources sign timestamp.deliveryId.body with HMAC-SHA256 and send the signature in x-signature.BitbucketBitbucket Cloud repository webhooks cover pushes, pull request changes, and issue events.