Why we don't need to verify the webhook when using google pub/sub?

Technical Q&A
1

Hi,

i’ve followed this two tutorial to create register and use a webhook :

https://shopify.dev/apps/webhooks/configuration/google-cloud#google-cloud-pub-sub-message-structure

https://www.youtube.com/watch?v=m9MQyRWnMdU

In the first one they say : “unlike with an HTTP webhook, you don’t need to perform HMAC verification”

I don’t understand why, no verification is needed !

How, can i be sure that is shopify who call my google pub/sub route registered in the webhook and not another person with bad intention ?

Can someone help me understand this ?

2

You gave Shopify’s service account explicit permission to trigger your webhook. Only systems with access to that Service Account (which is Shopify) can authenticate using that service account.

Read more about Google’s service accounts:

https://cloud.google.com/iam/docs/service-accounts