We have submitted our app to shopify to get it listed on the shopify store and they told us to update our security settings in which they asked us to include webhook authorization, in which whenever we receive a webhook request from shopify we need to match a hmac key that is present in the headers of the request and a hmac key that we will calculate on our side using the app’s API SECRET KEY that we get from shopify dashboard of our PUBLIC APP and the msg body sent from the shopify. In this we have tried a couple of ways to match the two HMACs, we have tried using the full body of the msg, only the data part of the msg which contains only the order related info(excluding headers), only the headers of the msg(excluding the data part of the msg), but nothing worked. We are able to generate hmac using this data but it is not matching with the hmac sent in the header of the msg body. Most important thing I would like to confirm is that for validating shopify webhooks, the key that we use is our public app’s API secret key value and what portion of the msg body should we use to calculate the HAMC on our end.