i am trying to verify the app proxy signature but it is not working.
i followed the documentation and i made sure i am using the correct secret key from the partner dev dashboard, here is my code:
def verify_hmac(request: Request) → bool:
qs = request.url.query
print(f'Raw query string: "{qs}"')
pairs = parse_qsl(qs, keep_blank_values=True)
params = dict(pairs)
print(f"Parsed params: {params}")
signature = params.get("signature")
if not signature:
return False
timestamp = params.get("timestamp")
if not timestamp:
return False
try:
ts_int = int(timestamp)
except ValueError:
return False
if abs(int(time.time()) - ts_int) > MAX_TIMESTAMP_AGE:
return False
message = ""
for k, v in params.items():
if k != "signature":
message += f"{k}={v}&"
message = message.rstrip("&")
print(f"Message before filtering: {message}")
computed = hmac.new(
SHOPIFY_APP_SECRET.encode("utf-8"),
message.encode("utf-8"),
hashlib.sha256
).hexdigest()
print("Shopify signature:", signature)
print("String to sign:", message)
print("Computed signature:", computed)
return hmac.compare_digest(computed, signature)