I have several webhooks on my store, which were created in the Shopify notifications section of admin, and they all pass webhook HMAC verification using my store’s secret for notifications.
Using GraphQL and a private app, I’ve created a webhook subscription to the bulk_operations/finish topic, so that I can get notifications when a bulk operation finishes. When creating the webhook subscription I am using my private app’s permanent access token.
However, the secret that validates webhook topics that I created in my Shopify admin, does not validate webhooks created using my private app, which makes sense. The docs for webhook validation state that the “X-Shopify-Hmac-SHA256 header…is generated using the app’s client secret”. So, with that I have tried using my private app’s secret, and my private app’s permanent access token to create an HMAC to validate the webhook’s HMAC, but neither the app’s client secret nor the permanent access token create the same HMAC as the webhook’s HMAC.
This user stated “GraphiQL app uses different credentials when building the webhook subscription”, but I can’t find any documentation to support that claim other than the secret should be the private app’s client secret. I’ve tried creating the bulk_operations/finish webhook subscription using the REST API as well, but the results are the same.
I guess my question is, what secret is being used for webhooks created using my private app? Or is there some kind of special handling for the bulk_operations/finish webhook topic? I can’t imagine there would be anything different about creating an HMAC for bulk_operations/finish.
UPDATE (My issue is resolved)
Was simply using the wrong client secret. Had to go through several private apps I have installed until I found the private “custom” app that is being used when subscribing to webhook topics.