Is X-Shopify-Hmac-SHA256 guaranteed on Google Pub/Sub webhook deliveries?

Webhooks and Events
,
1

We recently moved our app’s webhook subscriptions from HTTPS to Google Cloud Pub/Sub (uri = "pubsub://{project-id}:{topic-id}", API version 2026-04).

The docs state that “HMAC verification applies to HTTPS deliveries only. Google Cloud Pub/Sub and Amazon EventBridge deliveries don’t require it.” (strong statement btw but lets continue…)

However, every Pub/Sub message we received (so far during our testing) carries the signature as a message attribute:

{
  "X-Shopify-Topic": "products/update",
  "X-Shopify-Shop-Domain": "example.myshopify.com",
  "X-Shopify-Webhook-Id": "…",
  "X-Shopify-Event-Id": "…",
  "X-Shopify-Triggered-At": "…",
  "X-Shopify-API-Version": "2026-04",
  "X-Shopify-Hmac-SHA256": "…",
  "Content-Type": "application/json"
}

Three questions:

  1. Is this attribute a supported part of Pub/Sub delivery, or incidental and liable to be removed without notice?
  2. If supported, what exactly is signed? We assume the raw message data bytes as published, before any decoding, but this is not documented for this transport.
  3. Are the Pub/Sub message attribute names documented anywhere? We could only find the HTTP header table.

The reason it matters: with Pub/Sub delivery, the only thing authenticating a message is the IAM policy on the topic, and delivery@shopify-pubsub-webhooks.iam.gserviceaccount.com is a single publisher identity shared across all apps using this transport. The per-app HMAC is the only signal that distinguishes a message generated for our app from any other message published by that identity, including one misrouted from a different app. We would like to verify it, but not build on an undocumented attribute without knowing whether it is guaranteed and maintained.

Thank you All

Luca

2

I do not have the response to your questions.

However, if you’re relying on pub-sub you’re probably optimizing for volume. Checking the signature for every single message is going into the opposite direction and you already have the IAM authentication that, if well managed, ensures that only shopify can publish messages.

I’d recommend not checking the signature. It would be a double authentication check.

Attributes in the message will probably give you what you need to ensure the origin (shop domain…)

3

Thank you for your reply and honesty. @Soufiane_Ghzal.

I stand by my point, there is value in confirming that message was meant for our app, without trusting a single point of failure. HMAC parsing takes sub-milliseconds.

We will use the feature as its provided and hope Shopify will see the value too, one day.

Luca

4

My guess it that it’s reflecting what you get in the http webhooks, so they probably wouldn’t remove the attributes silently as it would break many apps.

Additionally they’ve been working on the new event system so I don’t see the webhooks getting new releases until they’ll probably eventually deprecate it.

Events are still in developer preview About Events and webhooks

I’d recommend checking it and if you have any feedback about it open a discussion dedicated to it or ask in the general thread: Next Generation Events now available in Developer Preview

You’ll get more chances to get a answer and possibly an update going into your direction as it’s where Shopify is putting the efforts right now.