Hey, I’d recommend you read this doc on how to setup and process your compliance webhooks.
Its critical that you do these to comply with any local or global laws on data protection for example GDPR
How can I register webhooks in my app?
I’m not using the Shopify CLI — I’ve created the app directly from the Shopify Developer Dashboard.
You can specify them in your config file.
Hello all,
I used the shopify-app-express npm package to develop my app. As far as I know, there is no option for a .toml file. I used this code to register the webhooks:
const webhookHandlers = {
SHOP_REDACT: {
deliveryMethod: DeliveryMethod.Http as const,
callbackUrl: shopify.config.webhooks.path,
callback: async (
topic: string,
shop_domain: string,
body: string,
webhookId: string,
apiVersion?: string,
subTopic?: string,
context?: any,
) => {},
},
CUSTOMERS_REDACT: {
deliveryMethod: DeliveryMethod.Http as const,
callbackUrl: shopify.config.webhooks.path,
callback: async (
topic: string,
shop_domain: string,
body: string,
webhookId: string,
apiVersion?: string,
subTopic?: string,
context?: any,
) => {},
},
CUSTOMERS_DATA_REQUEST: {
deliveryMethod: DeliveryMethod.Http as const,
callbackUrl: shopify.config.webhooks.path,
callback: async (
topic: string,
shop_domain: string,
body: string,
webhookId: string,
apiVersion?: string,
subTopic?: string,
context?: any,
) => {},
},
APP_UNINSTALLED: {
deliveryMethod: DeliveryMethod.Http as const,
callbackUrl: shopify.config.webhooks.path,
callback: async (
topic: string,
shop_domain: string,
body: string,
webhookId: string,
apiVersion?: string,
subTopic?: string,
context?: any,
) => {// some code},
}
}
app.post(shopify.config.webhooks.path, shopify.processWebhooks({ webhookHandlers }))
But the compliance webhook check also fails for me.
The APP_UNINSTALLED code is executed when I uninstall the app. So the general webhook handler registration should work, right?.
But why does the check fail for the compliance webhooks?
Appreciate any help!
Hey, you can also these in your TOML file now just FYI. App configuration
Shopify is moving the config to TOML for all apps with the move to the dev dashboard. About Dev Dashboard
I imagine it’s not working because in your code sample. You can just handling these webhooks to an empty function and not processing the webhooks or returning a status code.
You must properly implement the compliance webhooks to comply with laws around the world, you can read more on why they are important here Privacy law compliance
The automated check is testing two separate things, and it’s usually the second one that fails:
1. Subscription — the three topics declared in shopify.app.toml, then deployed:
[[webhooks.subscriptions]]
uri = "/webhooks/customers/data_request"
compliance_topics = ["customers/data_request"]
[[webhooks.subscriptions]]
uri = "/webhooks/customers/redact"
compliance_topics = ["customers/redact"]
[[webhooks.subscriptions]]
uri = "/webhooks/shop/redact"
compliance_topics = ["shop/redact"]
Then shopify app deploy. Declaring them in the TOML without deploying is the most common miss.
2. HMAC verification — each endpoint must verify the X-Shopify-Hmac-Sha256 header against your app secret and return 401 Unauthorized on an invalid signature. The check actively sends a bad-HMAC request and expects the 401; returning 200 (or 500) on a forged request fails the check even when your subscriptions are correct. Endpoints also have to accept POST with Content-Type: application/json.
If subscriptions are deployed and the endpoint 401s on bad HMAC, the check passes.
(optional) If you’d rather not hand-roll it, Term Tool outputs this exact TOML block and the HMAC-401 handler — but the above is the whole of it by hand.