Provider Guide
Shopify
Receive order, fulfillment, and customer events locally. Verify HMAC signatures and replay events without re-creating real orders.
1. Start the CLI
npx @anonymilyhq/cli listen 3000
2. Register the webhook in Shopify
- Go to Shopify Admin → Settings → Notifications → Webhooks.
- Click Create webhook.
- Choose the event (e.g.
orders/paid), set format to JSON, and paste your Anonymily URL. - Shopify signs every request with a secret shown in the webhook detail page. Copy it.
3. Verify the HMAC signature
const crypto = require('crypto');
function verifyShopify(rawBody, hmacHeader, secret) {
const digest = crypto
.createHmac('sha256', secret)
.update(rawBody)
.digest('base64');
return crypto.timingSafeEqual(
Buffer.from(hmacHeader),
Buffer.from(digest)
);
}
app.post('/shopify/webhook', express.raw({ type: '*/*' }), (req, res) => {
const hmac = req.headers['x-shopify-hmac-sha256'];
if (!verifyShopify(req.body, hmac, process.env.SHOPIFY_WEBHOOK_SECRET)) {
return res.status(401).send('Invalid HMAC');
}
const event = req.headers['x-shopify-topic'];
const body = JSON.parse(req.body.toString());
console.log('Shopify event:', event, body.id);
res.status(200).send('OK');
});