# Verify a Shopify Webhook Signature

**URL:** <https://discourse.nodered.org/t/verify-a-shopify-webhook-signature/65803>\
**Category:** General\
**Created:** [29 July 2022 23:41 UTC](https://discourse.nodered.org/t/verify-a-shopify-webhook-signature/65803 "2022-07-29T23:41:20Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Landsailor](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/landsailor/32/62070_2.png) [@Landsailor](https://discourse.nodered.org/u/Landsailor)\
**Post date:** [29 July 2022 23:41 UTC](https://discourse.nodered.org/t/verify-a-shopify-webhook-signature/65803/1 "2022-07-29T23:41:20Z")

</div>

I am trying to figure out how to [verify a signature header](https://shopify.dev/apps/webhooks/configuration/https#verify-a-webhook) sent with a Shopify Webhook, but there's something that I'm missing. It feels like it should be possible [using this crypto-js palette](https://flows.nodered.org/node/node-red-contrib-crypto-js-dynamic) but I can't seem to get it configured correctly.

 ![Shopify Webhook Signature Calc](https://us1.discourse-cdn.com/flex026/uploads/nodered/original/3X/e/4/e4fbd188ff9b77282f4bbcaf45701483ac8d3725.png)

Basically, hash the payload with the secretKey, Base64 encode it, and match it to the header.

Here's the latest attempt:

```auto
[{"id":"b815b244ef6bb443","type":"inject","z":"ed9b692543fdc4ea","name":"","props":[{"p":"payload"},{"p":"secretKey","v":"secretKey","vt":"flow"}],"repeat":"","crontab":"","once":false,"onceDelay":0.1,"topic":"","payload":"orderData","payloadType":"flow","x":160,"y":1060,"wires":[["7fb355187ffd0456","6860c382159a53aa"]]},{"id":"7fb355187ffd0456","type":"debug","z":"ed9b692543fdc4ea","name":"inject output","active":true,"tosidebar":true,"console":false,"tostatus":false,"complete":"true","targetType":"full","statusVal":"","statusType":"auto","x":350,"y":980,"wires":[]},{"id":"6860c382159a53aa","type":"hmac","z":"ed9b692543fdc4ea","name":"","algorithm":"HmacSHA256","key":"flow.signature","x":390,"y":1060,"wires":[["cb8e2fe905e99663","5754dd8ecd711ad9"]]},{"id":"cb8e2fe905e99663","type":"debug","z":"ed9b692543fdc4ea","name":"hmac output","active":false,"tosidebar":true,"console":false,"tostatus":false,"complete":"true","targetType":"full","statusVal":"","statusType":"auto","x":590,"y":980,"wires":[]},{"id":"5754dd8ecd711ad9","type":"digest","z":"ed9b692543fdc4ea","name":"","algorithm":"SHA256","x":610,"y":1060,"wires":[["1fee6edaa1aacc06","905eb409b6f77ff0"]]},{"id":"1fee6edaa1aacc06","type":"debug","z":"ed9b692543fdc4ea","name":"digest output","active":true,"tosidebar":true,"console":false,"tostatus":false,"complete":"true","targetType":"full","statusVal":"","statusType":"auto","x":810,"y":980,"wires":[]},{"id":"905eb409b6f77ff0","type":"encode","z":"ed9b692543fdc4ea","name":"End: UTF8","encode":"Utf8","x":850,"y":1060,"wires":[["a31ec252047a0968","12d48f8fd954067a"]]},{"id":"a31ec252047a0968","type":"encode","z":"ed9b692543fdc4ea","name":"Encode Base64","encode":"Base64","x":1060,"y":1060,"wires":[["e266a308cf783c99"]]},{"id":"12d48f8fd954067a","type":"debug","z":"ed9b692543fdc4ea","name":"utf8 output","active":true,"tosidebar":true,"console":false,"tostatus":false,"complete":"true","targetType":"full","statusVal":"","statusType":"auto","x":1010,"y":980,"wires":[]},{"id":"e266a308cf783c99","type":"debug","z":"ed9b692543fdc4ea","name":"base64 output","active":true,"tosidebar":true,"console":false,"tostatus":false,"complete":"true","targetType":"full","statusVal":"","statusType":"auto","x":1260,"y":980,"wires":[]}]

```

The last UTF8 encode doesn't make any sense to me, but the Base64 encode returns an error without it.

I'd rather _not_ install another dependency if these nodes can do it....which it feels like it could.

Thanks in advance!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex026/uploads/nodered/original/1X/d073cd938eafa2e558d7c2cd59003b3ef4963033.png) [@system](https://discourse.nodered.org/u/system)\
**Post date:** [27 September 2022 23:41 UTC](https://discourse.nodered.org/t/verify-a-shopify-webhook-signature/65803/2 "2022-09-27T23:41:38Z")

</div>

This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.