Hey guys,
I've been trying to verify my Shopify web hooks that I have set up via Shopify -> Settings -> Notifications.
I'm trying to run a webhook once an Order is paid to connect to a fulfillment provider.
However, I seem to be stuck with the first task of validating the webhook.
For those who know, I am using Pipedream to validate and test the request but I've had no luck so far.
Now for the coding part:
The key I am using to try to calculate the authenticity of the webhook is the one specified below the web hooks in Shopify -> Settings -> Notifications.
export default defineComponent({
async run({ steps, $ }) {
const hash = steps.trigger.event.headers["x-shopify-hmac-sha256"];
const body = steps.trigger.event.body
const hmac = crypto
.createHmac('sha256', secretKey)
.update(Buffer.from(JSON.stringify(body)), "utf8", "hex")
.digest('base64')
if(hash === hmac) {
console.log("good");
} else {
console.log("bad")
}
}
I've seen several examples working with rawBody. From what I gather this is the body (that contains body.id = order id beneath it) as a Buffer in node.js
Therefore I have tried to convert the body, which is an object by the time I receive it, to a Sting and then to a buffer.
I tried parsing the String to the update() function, I've tried the body itself, I also played around with the parameters in update and added "utf8", "hex", separately and in combination.
As I'm unsure whether the key found under the webhooks created in Shopify -> Settings -> Notifications I also tried using a token from a custom app and the secret etc. I just can't seem to find the right settings.
I am using an actual payload from the store to test however I am using one that's about an hour old.
Could anyone help me out here?
Thanks in advance!
Rhys
