How to Test Shopify Webhooks
Use a temporary HookTray endpoint to inspect what Shopify delivers in real time. No account is required, and request history stays in your browser.
Choose a Shopify webhook topic
Shopify webhook topics identify the store event that produces a delivery. For example, orders/create reports a new order, products/update reports a product change, and refunds/create reports a newly created refund. Subscribe only to topics your integration needs.
Review Shopify's topic and subscription model in the Shopify webhooks documentation.
Subscribe to the topic
Open HookTray and copy the temporary hook URL before configuring a Shopify subscription.
For app configuration, add a subscription to shopify.app.toml. Replace the example URI with the temporary HookTray URL you copied:
[[webhooks.subscriptions]]
topics = ["orders/create"]
uri = "https://your-temporary-hook-url"As a programmatic alternative, create the subscription with the GraphQL Admin API. The topics and destination URI are configured through your chosen path; do not configure the same subscription both ways.
Follow the Shopify subscription documentation for the current configuration and Admin API workflows.
Test a real store action
- Perform the corresponding real store action, such as creating an order, updating a product, or creating a refund.
- Return to HookTray and select the captured delivery for inspection.
A real store action exercises Shopify's actual event and delivery path, so use it for end-to-end confidence in your subscription and workflow.
Use a Shopify CLI sample trigger
A Shopify CLI sample trigger is useful for quickly sending a supported topic to your temporary URL. The CLI payload is fixed, and a CLI-triggered webhook is not retried on failure. A real store action is needed for end-to-end confidence.
See the Shopify CLI webhook trigger documentation for command options and supported usage.
Inspect the Shopify delivery
Check X-Shopify-Topic for the delivered topic, X-Shopify-Webhook-Id for the unique delivery identifier, and X-Shopify-Hmac-Sha256 for the signature supplied by Shopify. Inspect the JSON payload in the incoming request. HookTray shows the incoming request and returns its acknowledgement.
Inspect response status and timing for your eventual application handler in Shopify delivery logs. See the Shopify delivery logs guidance.
HookTray displays the HMAC header but does not currently validate it. Your application must verify the HMAC against the unmodified raw request body and its Shopify client secret. Follow the Shopify delivery verification documentation.
Troubleshoot Shopify webhook tests
Raw-body HMAC verification
HMAC verification requires the raw request body. Parsing or changing its bytes before verification can make a valid delivery fail the check.
Duplicate deliveries and idempotency
A webhook can arrive more than once. Use the Shopify webhook ID as an idempotency key so duplicate deliveries do not repeat side effects.
Unordered events
Shopify does not guarantee delivery order. Design handlers to tolerate related events arriving in a different order than they occurred.
Response timeout
Shopify uses a five-second response timeout. Acknowledge the delivery quickly and move longer processing out of the request path in your application.
Retries and repeated failures
Shopify retries failed HTTPS deliveries up to eight times over four hours. Webhook subscriptions created through the Admin API can be automatically deleted after repeated failures. Subscriptions declared in app configuration are not automatically deleted for delivery failures.
For current failure and retry details, read the Shopify webhook troubleshooting documentation.