How to Configure and Test GDPR Mandatory Webhooks

[Sharan_oapps]

For a Public Embedded app, how to configure and test the three Mandatory GDPR Webhooks.. Kindly help me out in detail pls.

[AnonJack · Accepted solution]

You need to have those available as post methods in your server and verify the HMAC values coming in.

So for example `/webhoolks/shop/redact` should first verify the HMAC value coming in header, if the value compares okay with your private key then good otherwise send out 401.

To test, create a customer in your test store, go to that customer and hit request data, it should trigger your `/webhooks/customers/data_request`

[Sharan_oapps]

Thank you for your valuable reply!

But to verify Webhook, I cant find it for the Node.js code snippets in the Documentation link https://shopify.dev/apps/webhooks/configuration/https

[bishpls]

Because said documentation does not exist! 😄

See the comments in this Github Issue for a minimal-but-functional way of implementing the manual verification: https://github.com/Shopify/shopify-node-api/issues/256

[Hieunk]

Hello, i test customers/request_data on store, but how could i check delivery log, and how i know which status the app response 

[adelespinasse]

The `customers/data_request` and `customers/redact` webhooks are called only "If your app has been granted access to customer or order data". And `shop/redact` is called "48 hours after a store owner uninstalls your app". I assume it is not called if the app is reinstalled within those 48 hours.

https://shopify.dev/apps/webhooks/configuration/mandatory-webhooks

So if the app doesn't request access to order or customer data, then the only way to test any of these webhooks is to install the app on a test store, uninstall, then wait 2 days. If the mandatory webhooks have separate implementations, there's basically no way to test the other 2. (Though I guess it doesn't matter because they won't be called? It's weird that they're still "mandatory" in that case; the app store requirements don't mention any exceptions.)

[Martin-NZPost]

I have two questions

1) What is format the entire url of the webhook? 
Is it {app setup}{webhook}? i.e. the webhook is the path part only of the url
Or is it {webhook} only? i.e the webhook is fully qualified
I assume it is not {proxy}{webhook} as the store has been removed at that point

2) Also, our app is a legacy themes app which only gives access to update script tags, so only the store webhook is required. Correct?

Thanks

[Najiva]

Shopify-cli tool can trigger quite a lot of webhooks for testing, but mandatory ones are not there. 😞 So I guess you have to request access to customer data to test.

[babis21]

Hi, sorry for reviving this old topic, but just stuck on this one, so I need to wait for 10 days (at minimum) to test customers/redact? Isn't there a quickest way to test that this webhook works ok? It just sounds strange, inflexible and unproductive to have to wait for 10 days to develop a feature!

[jcquigs]

https://shopify.dev/docs/api/shopify-cli/app/app-webhook-trigger

use this

[babis21]

Hi, thanks for your reply, yes I am using it for developing but wondering how can I perform end to end testing and UAT after installing the app in the store. It seems strange to have to wait for 10 days to verify that it all works ok, and try to troubleshoot if something is not OK (e.g. wrong configuration).