How to fix: Error: Could not validate request HMAC

Retired Boards Appdev Tools

Topic summary

Webhook processing fails with “Failed to process webhook: Error: Could not validate request HMAC” when using @Shopify_77/shopify-app-express to run a Shopify app server. The reporter suspects a misconfigured hostName in the API settings but isn’t certain.

Configuration shared (code snippet central to the issue): hostScheme: “http”, hostName: “localhost:3030”, isEmbeddedApp: true, webhooks path: “/api/webhooks”, auth paths “/api/auth” and “/api/auth/callback”, accessMode: “offline”, with CustomSessionStorage.

Technical context: HMAC (hash-based message authentication code) is used by Shopify to verify webhook authenticity; this error indicates the webhook request’s signature didn’t match what the app computed.

Another participant reports experiencing the same problem and cannot find a solution.

No fix or workaround has been provided yet. The discussion remains open with a request for guidance on correct configuration and resolving the HMAC validation failure.

Summarized with AI on January 23. AI used: gpt-5.
1

Hi all,

I am using the shopifyApp from** @Shopify_77 /shopify-app-express**to setup the Shopify webserver but I keep running into this error:

Failed to process webhook: Error: Could not validate request HMAC

I suspect that I am not passing the correct hostName to the api key but not sure how to fix this issue.

Can someone please help me understand what I am doing wrong? Thank you!

The setup:

const shopify = shopifyApp({

api: {

apiVersion: LATEST_API_VERSION,

restResources,

billing: undefined,

apiKey: 'hidden',

apiSecretKey: 'hidden',

accessMode: 'offline',

scopes: ['read_products','write_products','write_customers','write_draft_orders','unauthenticated_read_product_listings','read_product_listings','unauthenticated_write_checkouts'],

hostScheme: 'http',

hostName: 'localhost:3030',

isEmbeddedApp: true,

 },

auth: {

path: "/api/auth",

callbackPath: "/api/auth/callback",

 },

webhooks: {

path: "/api/webhooks",

 },

sessionStorage: new CustomSessionStorage()

});
2

Anyone? I’m facing the same problem and can’t find a solution.

1 Like