Overview

Shopify sends webhooks for orders, customers, products, and more. But if your order processing system runs on an internal network, how do you receive them?

Skooh bridges the gap—Shopify sends to Skooh, Skooh forwards to your internal service.

Step 1: Create a Skooh Endpoint

1. Log in to Skooh
2. Click Create Endpoint
3. Name it "Shopify Orders" (or similar)
4. Copy your webhook URL: `https://api.skooh.io/hook/abc123\`

Step 2: Configure Shopify Webhooks

In your Shopify Admin:

1. Go to Settings → Notifications → Webhooks
2. Click Create webhook
3. Select the event (e.g., "Order creation")
4. Paste your Skooh URL
5. Choose JSON format
6. Save

Repeat for other events you need:

• `orders/create`
• `orders/updated`
• `orders/fulfilled`
• `customers/create`

Note: Shopify's webhook UI may change. Refer to Shopify's official webhook documentation for the latest instructions.

Step 3: Run the Skooh Proxy

Using the Desktop App

1. Download and install the Skooh Desktop App
2. Enter your API key and hook token
3. Set your forwarding URL: `http://localhost:8080/webhooks/shopify\`
4. Click Connect

Using Docker

Alternatively, run the proxy as a Docker container:

docker run -d \\
  --name skooh-shopify \\
  -e SKOOH_TOKEN=abc123 \\
  -e SKOOH_API_KEY=your_api_key \\
  -e FORWARD_URL=http://order-service:8080/webhooks/shopify \\
  --restart unless-stopped \\
  skooh/proxy

Step 4: Handle the Webhook

Your internal service receives standard Shopify webhook payloads:

app.post('/webhooks/shopify', express.json(), async (req, res) => {
  const topic = req.headers['x-shopify-topic'];
  const shopDomain = req.headers['x-shopify-shop-domain'];
  
  console.log(\`Received \${topic} from \${shopDomain}\`);
  
  switch (topic) {
    case 'orders/create':
      await processNewOrder(req.body);
      break;
    case 'orders/fulfilled':
      await updateOrderStatus(req.body);
      break;
  }
  
  res.status(200).send('OK');
});

Verifying Shopify Webhooks

Shopify signs webhooks with HMAC-SHA256. Verify them:

const crypto = require('crypto');

function verifyShopifyWebhook(req, secret) {
  const hmac = req.headers['x-shopify-hmac-sha256'];
  const hash = crypto
    .createHmac('sha256', secret)
    .update(req.rawBody, 'utf8')
    .digest('base64');
  
  return hmac === hash;
}

app.post('/webhooks/shopify', express.raw({ type: 'application/json' }), (req, res) => {
  if (!verifyShopifyWebhook(req, process.env.SHOPIFY_WEBHOOK_SECRET)) {
    return res.status(401).send('Invalid signature');
  }
  
  const body = JSON.parse(req.body);
  // Process webhook...
});

Note: Skooh preserves the raw body and all headers, so signature verification works exactly as if Shopify connected directly.

Inspect and Replay

Inspecting Webhooks

In the Skooh dashboard, click on any webhook to see:

• Full headers (including `x-shopify-topic\