Join us for an upcoming Shopify Partner webinar on February 27, 2024. Discover the latest Checkout Extensibility features, and deep dive on improvements to Shopify Functions and Web Pixels. Register now for either the 10am EST or 2pm EST sessions.
Solved

What Shopify custom headers are sent in webhook POST requests?

jlamberg
Visitor
2 0 0

Hi,

 

We have a webhook created via the admin page (Settings -> Notifications -> at the bottom of the page) for Order Payment that is for the topic "orders/paid". Based on our logs, I see the following custom Shopify headers, i.e. the ones starting with "X-Shopify-", present in each request:

 

X-Shopify-Api-Version 2022-10
X-Shopify-Hmac-Sha256 ...
X-Shopify-Order-Id 123456...
X-Shopify-Shop-Domain foobar.myshopify.com
X-Shopify-Test false
X-Shopify-Topic orders/paid
X-Shopify-Webhook-Id deadbeef..

 

The page https://shopify.dev/apps/webhooks mentions:

 

In addition to the message payload, each webhook message has a variety of headers containing additional context.

For example, an orders/create webhook can include the following headers:

The following header fields are used:

Also, the page https://shopify.dev/apps/webhooks/configuration/https#step-5-verify-the-webhook states:

 

Each webhook request includes a base64-encoded X-Shopify-Hmac-SHA256 header

 

Now, I think I have read all documentation about webhooks I could find on Shopify, yet I wasn't able to find answers to my below questions:

 

  1. Are the custom headers above all the ones that are sent, or can there be more?
  2. What custom headers are sent with what topics, or are they always the same for all topics?
  3. Is the set of custom headers, above or otherwise, always sent, i.e. can I trust them to be always there for a request?
  4. Is there documentation about these custom headers apart from what is briefly mentioned in https://shopify.dev/apps/webhooks?

 

Any help to answer my questions is appreciated.

Accepted Solution (1)

mrad
Shopify Staff (Retired)
63 10 15

This is an accepted solution.

Hey there, unfortunately we don't have documentation  on each set of headerss used for every Shopify topic, and they do differ slightly based on topic. However you can always rely on the `X-Shopify-Hmac-Sha256`, the `X-Shopify-Webhook-Id`, the `X-Shopify-API-Version` and the `X-Shopify-Shop-Domain` being there

mrad | Developer @ Shopify 
 - Was my reply helpful? Click Like to let me know! 
 - Was your question answered? Mark it as an Accepted Solution
 - To learn more visit Shopify.dev or the Shopify Web Design and Development Blog

View solution in original post

Replies 2 (2)

mrad
Shopify Staff (Retired)
63 10 15

This is an accepted solution.

Hey there, unfortunately we don't have documentation  on each set of headerss used for every Shopify topic, and they do differ slightly based on topic. However you can always rely on the `X-Shopify-Hmac-Sha256`, the `X-Shopify-Webhook-Id`, the `X-Shopify-API-Version` and the `X-Shopify-Shop-Domain` being there

mrad | Developer @ Shopify 
 - Was my reply helpful? Click Like to let me know! 
 - Was your question answered? Mark it as an Accepted Solution
 - To learn more visit Shopify.dev or the Shopify Web Design and Development Blog

jlamberg
Visitor
2 0 0

Hey Mrad,

 

Thank you for your reply.

 

Do you know whether there are any plans to improve the webhooks documentation, and possibly to include something like what I asked originally? When could we expect any improvement to be available?