How can I import Node's built-in 'crypto' library to use in a Shopify Function?

Shopify Apps

Topic summary

A developer is attempting to secure line item property data in a Shopify Function using HMAC verification to prevent discount tampering. The core issue: Node’s built-in crypto library cannot be imported into Shopify Functions.

Key findings:

  • Standard imports like import crypto from 'crypto' fail with “Could not resolve ‘crypto’” errors
  • Shopify Functions run in a highly restricted environment that doesn’t support native Node modules
  • External libraries also cannot be imported into this environment

Proposed workarounds:

  • Use crypto-js package with npm install crypto-js, then implement HMAC generation via CryptoJS.HmacSHA256() (though this may only work in custom extensions, not Functions)
  • Consider lightweight alternatives like js-sha256 that might work within the Function itself
  • Generate HMAC externally before passing values into the Function

Status: The discussion remains open with no confirmed solution for HMAC generation directly within Shopify Functions. The original poster hasn’t reported which approach ultimately worked.

Summarized with AI on October 29. AI used: claude-sonnet-4-5-20250929.
1

I’m working on a Shopify Function that can apply discounts via line item property/attribute data that can be added via our app.

The point of using ‘crypto’ would be to ensure that bad actors couldn’t tamper with the line item properties and receive discounts they didn’t earn.

I’ve been playing around with the idea of hashing the line item property data and generating an HMAC to do this.

However, I cannot figure out how to import the “crypto” library into the Function environment.

A basic import like:

import crypto from 'crypto';

Results in the following error:

 ERROR: Could not resolve "crypto"

What am I missing here?

I’ve seen this thread which seems related, but it also seems to relate directly to Remix.

Any ideas?

Thanks for any help / answers you can provide.

2

Hello,

For me in a custom extension to use the crypto functions the same way than Shopify here is what i did.
First import the package in global or on your extension section :

npm install crypto-js

Then in your extension add or import this function :

import CryptoJS from 'crypto-js';
import Hex from 'crypto-js/enc-hex';

async function createSHA256HMAC(payload) {
    const secret = '{your_secret/cryto_key}';
    const hash = CryptoJS.HmacSHA256(payload, secret);
    return Hex.stringify(hash);
}

Please take care of where you add your secret (don’t place it in files that could be exposed on front of customers).

3

There is no way to import external node libraries in the environment for shopify functions. I am in the same situation and will try to add a lightweight downloadable solution like js-sha256 to use It in the function itself.

How did you figure It out finally?

Thanks!!

4

You’re definitely on the right track — using an HMAC to secure line item properties is a clever approach to avoid tampering. As for importing Node’s crypto library, sadly Shopify Functions run in a very restricted environment, so native Node modules aren’t available.

5

You might need to look into external HMAC generation before passing values in. On another note, the crypto space mirrors that diversity too — loads of affiliate programs across exchanges, wallets, education and more. mydexchain.io is a good example of tapping into those different opportunities.