Delivery behaviour
Read from the vendor's own documentation, last checked 2026-08-06. Where the vendor states no number, this table carries none.
| Response budget | 5s 1 second to connect, 5 seconds for the whole request |
|---|---|
| Retry | 8 retries over 4 hours |
| Gives up | Subscriptions created through the Admin API are deleted after 8 consecutive failures, with a warning email to the app's emergency developer contact |
| Source | https://shopify.dev/docs/apps/build/webhooks/subscribe/https |
Signature
Verified against a working verifier proven by a test suite, not read from documentation. Last verified 2026-08-20.
| Algorithm | HMAC-SHA256 |
|---|---|
| Signed payload | raw body |
| Encoding | base64 |
| Header | x-shopify-hmac-sha256 |
| Tolerance | none enforced |
Verify it
The raw request body, byte for byte, before any JSON parsing. Every scheme on this page breaks the moment a framework re-serializes the payload.
const crypto = require("node:crypto");
// base64(HMAC-SHA256(secret, raw body))
const expected = crypto
.createHmac("sha256", hmacSecret) // admin webhooks: Settings → Notifications
.update(rawBody)
.digest("base64");
const received = Buffer.from(req.headers["x-shopify-hmac-sha256"] ?? "");
const wanted = Buffer.from(expected);
// timingSafeEqual throws on a length mismatch, so check that first.
const valid =
received.length === wanted.length && crypto.timingSafeEqual(received, wanted);Two different secrets exist: admin-created webhooks sign with the shared secret under Settings → Notifications, app-created ones with the app's client secret. Match how the webhook was created.
What bites
Shopify does not disable the subscription, it deletes it. A subscription made through the Admin API is deleted after 8 consecutive failures, with only a warning email to the app's emergency developer contact; nothing throws, and orders simply stop arriving. Recovery is a reconciliation job against the Admin API, because the missed events were never sent.
Read more
AnyHook sits in front of endpoints that receive from Shopify: it answers in about a second, retries on its own schedule when your server is down, and keeps every event replayable. Change one URL, keep your code.