---
title: "Verify Shopify Webhook Signatures — Free Online Tool | WebhookRelay"
meta:
"og:description": "Free online Shopify webhook signature verifier. Validate the X-Shopify-Hmac-Sha256 header against your app's API secret. Paste the payload, secret and signature to check it instantly — runs in your browser, no signup."
"og:title": "Verify Shopify Webhook Signatures — Free Online Tool"
description: "Free online Shopify webhook signature verifier. Validate the X-Shopify-Hmac-Sha256 header against your app's API secret. Paste the payload, secret and signature to check it instantly — runs in your browser, no signup."
---
# **Verify Shopify Webhook Signatures**
Shopify signs webhooks with HMAC-SHA256 over the raw request body and sends a **base64**-encoded digest in the `X-Shopify-Hmac-Sha256` header. The key is your app's API secret key (client secret). Paste the raw body, the secret and the header value.
**Raw request body (payload)**
**API secret key**
**Computed signature**
**Signature to verify **(X-Shopify-Hmac-Sha256)
**Paste the X-Shopify-Hmac-Sha256 value above to compare**
Everything runs in your browser — the payload and secret never leave this page. Want to verify a different provider? See the [webhook signature verifier hub](https://webhookrelay.com/verify-shopify-webhook-signature/verify-webhook-signature/) or the generic [HMAC generator](https://webhookrelay.com/verify-shopify-webhook-signature/hmac-verification/).
## **How Shopify signs webhooks**
1. Take the **raw** request body exactly as delivered.
2. Compute HMAC-SHA256 using your app's API secret key as the key.
3. Base64-encode the digest and compare it to `X-Shopify-Hmac-Sha256` with a constant-time check.
**References & official docs:**
- [Shopify — Verify a webhook (HTTPS delivery)](https://shopify.dev/docs/apps/build/webhooks/subscribe/https)
- [Shopify — Webhooks overview](https://shopify.dev/docs/apps/build/webhooks)
## **Verify Shopify signatures in code**
**Node.js**
```
const crypto = require('crypto');
const digest = crypto
.createHmac('sha256', process.env.SHOPIFY_API_SECRET)
.update(rawBody, 'utf8') // raw request body
.digest('base64');
const received = req.headers['x-shopify-hmac-sha256'];
const valid = crypto.timingSafeEqual(
Buffer.from(digest), Buffer.from(received));
```
**Python**
```
import hmac, hashlib, base64
digest = base64.b64encode(hmac.new(
api_secret.encode(), raw_body, hashlib.sha256).digest()).decode()
received = request.headers['X-Shopify-Hmac-Sha256']
valid = hmac.compare_digest(digest, received)
```
## **Frequently asked questions**
**Which secret signs Shopify webhooks?**
Your app's API secret key (client secret) for app webhooks. Webhooks created in the Shopify admin are signed with a separate secret shown in Settings → Notifications.
**Why must I use the raw body?**
Shopify computes the HMAC over the exact bytes sent. Parsing and re-serializing the JSON changes whitespace and key order, which breaks the digest.
## **Verify other providers**
[Stripe](https://webhookrelay.com/verify-shopify-webhook-signature/verify-stripe-webhook-signature/) [ GitHub](https://webhookrelay.com/verify-shopify-webhook-signature/verify-github-webhook-signature/) [ Slack](https://webhookrelay.com/verify-shopify-webhook-signature/verify-slack-webhook-signature/) [ Twilio](https://webhookrelay.com/verify-shopify-webhook-signature/verify-twilio-webhook-signature/) [**S** Standard Webhooks](https://webhookrelay.com/verify-shopify-webhook-signature/verify-standard-webhooks-signature/) [ Square](https://webhookrelay.com/verify-shopify-webhook-signature/verify-square-webhook-signature/) [**L** LINE](https://webhookrelay.com/verify-shopify-webhook-signature/verify-line-webhook-signature/) [**A** Airwallex](https://webhookrelay.com/verify-shopify-webhook-signature/verify-airwallex-webhook-signature/) [**M** MyFatoorah](https://webhookrelay.com/verify-shopify-webhook-signature/verify-myfatoorah-webhook-signature/) [ Zendesk](https://webhookrelay.com/verify-shopify-webhook-signature/verify-zendesk-webhook-signature/) [ DocuSign](https://webhookrelay.com/verify-shopify-webhook-signature/verify-docusign-webhook-signature/) [**K** Klarna](https://webhookrelay.com/verify-shopify-webhook-signature/verify-klarna-webhook-signature/) [**A** Attio](https://webhookrelay.com/verify-shopify-webhook-signature/verify-attio-webhook-signature/)
[HMAC Generator](https://webhookrelay.com/verify-shopify-webhook-signature/hmac-verification/) [CloudEvents Validator](https://webhookrelay.com/verify-shopify-webhook-signature/cloudevents-validator/) [Webhook Tester (Bin)](https://webhookrelay.com/verify-shopify-webhook-signature/webhook-bin/)
Receiving Shopify webhooks on a server behind a firewall or on localhost? Webhook Relay can [forward them to your internal service](https://webhookrelay.com/verify-shopify-webhook-signature/webhooks/) and even [verify or transform them](https://webhookrelay.com/verify-shopify-webhook-signature/features/transform-webhooks/) before delivery.