Trouble with hmac verification for multiple bulk actions: any solutions?

Shopify Apps

Topic summary

Developers are struggling to verify HMAC signatures for Shopify bulk actions when multiple product IDs are selected. The standard HMAC verification code works for single IDs but fails with multiple IDs.

The Solution:

  • Parse the incoming URL query (e.g., ids%5B%5D=1&ids%5B%5D=2&ids%5B%5D=3)
  • Extract ID values into an array
  • Convert the array to a specific string format: ids=["1", "2"]
  • Key formatting requirements: double quotes around each ID, single whitespace between values, square brackets
  • Insert this formatted string into the alphabetically sorted query parameters before generating the HMAC hash

Critical Details:

  • URL query parameters must be sorted alphabetically
  • The ids parameter must be a formatted string, not an actual array data type
  • Precise formatting is essential for verification to succeed

Community Reaction:
Multiple developers expressed frustration that this undocumented requirement caused them to abandon or delay implementing bulk action features. Some participants report the solution works after testing, though at least one user still encounters issues even after applying the fix. There’s consensus that Shopify should document this requirement properly.

Summarized with AI on November 11. AI used: claude-sonnet-4-5-20250929.
2

Let me know what you come up with. I’m essentially having the same exact issue. I saw this thread here providing more details on what is expected from the hmac calculation but it’s still failing for me. For reference here is the query object I’m using to validate HMAC:

{ hmac:
‘insert_hmac_here’,
locale: ‘en’,
timestamp: ‘1571680135’,
shop: ‘xxxxxxxx.myshopify.com’,
ids: [ ‘1’ ] }