How do I authenticate a webhook in PHP?

[allanyip]

Hi!

I created a webhook and subscribed to the topic `create_order` via the Shopify Admin. Hmac validation goes well as I'm getting a "verified" message 🙂

Now I would like to expand my webhook code by retrieving data from a Shopify endpoint. However, in order to retrieve data, the webhook must be authenticated. How do I authenticate? I can only find the `authorization code` way to do so, but that means somewhere in the flow a login screen pops up. I know that `client credentials` is not possible as far as I know.

I have written the webhook in vanilla PHP, so no framework. 

Thanks in advance!

Allan

[noahsark769 · Accepted solution]

If I'm understanding correctly, you'll need to make a request to the Shopify API when your server receives the webhook. In order to do this, you'll need to already have generated an API access token - usually this should happen when the user installs the Shopify app. When you've saved that token in your database, you can use it when you receive the valid webhook to call the API. There's some info about how to get these tokens and authenticate here: https://shopify.dev/apps/auth

[allanyip]

Thanks for your help Noahsark!

Since my webhook code and frontend code do not share the same stack, I've delegated the access token from the frontend to the backend by using Redis. Now I'm able to call the Shopify API, because I have the token there.