verifyShopifyHmac

Verifies a Shopify webhook HMAC signature using a constant-time byte comparison to guard against timing attacks.

Signature

function verifyShopifyHmac(rawBody: string, headerHmac: string, secret: string): boolean;

Parameters

Returns

true when the computed digest matches the header value; false when the header is absent, the byte lengths differ, or the digest does not match.

Example

const valid = verifyShopifyHmac(
    rawBody,
    request.headers.get('x-shopify-hmac-sha256'),
    process.env.SHOPIFY_WEBHOOK_SECRET!,
);
if (!valid) return new Response('Forbidden', { status: 403 });

Related

ShopifyParseInput parseShopifyWebhook