CarrierService callback_url authentication

Retired Boards Appdev Authentication
1

For the CarrierService callback_url, looking for the recommended way to verify the requests coming in on my callback_url are from Shopify. I tried using:

export async function action({ request }) {
    const { } = await authenticate.webhook(request);

    return json({ ... })
};

But that gave a 400 error.

I see there is a signature header: x-shopify-hmac-sha256

Is that the recommended mechanism to verify the authenticity of the request? Anything in the shopify-api-js lib I can use the validate this, or do I have to hand-write something?

Certainly this isn’t expected to be a purely public API allowing just anyone to call it - what am I missing?

2

In the case of CarrierService you only need to verify the HMAC signature which is available via a helper method in shopify-api-js’ utils. Any request that doesn’t verify you would deny since it wouldn’t be a genuine Shopify request.