The original title is: "How to Verify Shopify Webhook Signatures (and the Base64 Raw-Body Trap)"

Short summary

Shopify webhook verification fails most often because the HMAC is base64-encoded (not hex like Stripe/GitHub) and because express.json() parses the body before you can hash the raw bytes. The fix: use express.raw() on the webhook route, compute HMAC-SHA256 with your app's client secret over the untouched Buffer, base64-encode the digest, and compare with crypto.timingSafeEqual. Parse JSON only after verification passes.

• •Shopify uses base64-encoded HMAC, not hex — copying Stripe/GitHub verification code will silently fail
• •express.json() consumes the raw body before you can verify it; use express.raw() on the webhook route instead
• •Compare digests with crypto.timingSafeEqual to avoid timing attacks; guard length first to prevent throws

Generated with AI, which can make mistakes.