Webhook Workflow Verify Integrity Shopify

[Laith_Charles]

I can see the hmac stuff in the header here... ["startTrigger.data"].headers["x-shopify-hmac-sha256"]. I am not super familiar with encryption, the values don't match because they are hashed? So I basically need to decript the value I see here and compare it to my client secret and then if the value matches return a 200 and continue else return a 401. I am more familiar with Javascipt and the example is in Python. Other posts reference a crypto js menthod of implementing. Here are two relevant threads which reference this concept with no concrete solutions.

Validating Xero webhooks

Hey @MiguelOrtiz! Curious to know if you had any luck. Since it's possible to read headers in Workflows I imagine you could use a code block with a library like crypto js to check if the payload has been correctly hashed: [image] From there you can customize the response code based on the result of your code block to either return a 401 or a 200. [image] Since this would be built into the same endpoint as the main workflow you're trying to run you'll likely need to add in some additional ro…

Is it possible to access a Webhook's headers from Workflows?

When setting a webhook trigger, is there a way to access the headers sent with the request? I don't see this information in startTrigger.data, or startTrigger.metadata (which seems to always be null)