This is an accepted solution.
After you configure a webhook subscription, the events that you specified will trigger a webhook notification each time they occur. This notification contains a JSON payload, and HTTP headers that provide context. For example, the orders/create webhook includes the following headers:
Some HTTP headers are particularly useful for your app. For example, X-Shopify-Hmac-Sha256 is used to verify webhooks, and X-Shopify-Shop-Domain is used to identify the store that's associated with them.