Does HookSense support Shopify's Base64-encoded HMAC signatures?

Yes. Shopify uses HMAC-SHA256 encoded as Base64 in the X-Shopify-Hmac-Sha256 header. HookSense verifies it automatically once you add your app's API secret key.

How do I test Shopify webhooks locally without exposing my dev server?

Point Shopify at a HookSense webhook URL, then run `npx hooksense listen -p 3000 --path /api/integrations/shopify` to forward captured events to your local server. No tunneling tool required.

What Shopify events can I capture with HookSense?

Any Shopify webhook topic: orders/create, orders/paid, products/update, customers/create, app/uninstalled, and the mandatory GDPR webhooks. HookSense captures the full payload and headers so you can inspect every field before writing your handler.

Shopify Webhook Tester

Test Shopify webhooks in real-time — no signup, no tunnels.

Get a free webhook URL in one click, paste it into your Shopify dashboard, and watch events stream in live. Verify X-Shopify-Hmac-Sha256 signatures automatically, replay any request to your local server, and debug payloads with search and filters.

Get a free Shopify webhook URL Full Shopify setup guide

Why test Shopify webhooks with HookSense

Real-time WebSocket stream

Events appear the instant Shopify sends them. No polling, no refresh button.

HMAC-SHA256 (Base64) verification

Paste your signing secret once — HookSense verifies every Shopify request automatically.

One-click replay

Send any captured webhook back to your local server or production — rerun your handler without triggering new events.

CLI forwarding, no ngrok

Forward directly to localhost:3000 with npx hooksense listen.

Quick start — 3 steps

1
Get your free webhook URL
Create a free endpoint at hooksense.com. You get a unique URL instantly — no credit card, no config.
2
Paste it into Shopify
In the Shopify dashboard, add the URL as your webhook endpoint and pick the events you want (orders/create, orders/updated, etc.).
3
Trigger an event and watch it arrive
Fire a test event from Shopify — it lands in HookSense within milliseconds. Inspect headers, body, and signature. Replay when ready.

Forward to localhost

npx hooksense listen -p 3000 --path /api/integrations/shopify

Common Shopify webhook events

orders/create

orders/updated

orders/paid

orders/cancelled

products/create

products/update

customers/create

app/uninstalled

Testing tips specific to Shopify

Shopify uses Base64-encoded HMAC — HookSense handles this automatically
Mandatory webhooks (GDPR) must be registered in your Partner Dashboard
Use HookSense to inspect the full payload structure before writing your handler
Shopify has rate limits on webhook subscriptions — monitor with HookSense

Frequently asked

Does HookSense support Shopify's Base64-encoded HMAC signatures?: Yes. Shopify uses HMAC-SHA256 encoded as Base64 in the X-Shopify-Hmac-Sha256 header. HookSense verifies it automatically once you add your app's API secret key.
How do I test Shopify webhooks locally without exposing my dev server?: Point Shopify at a HookSense webhook URL, then run `npx hooksense listen -p 3000 --path /api/integrations/shopify` to forward captured events to your local server. No tunneling tool required.
What Shopify events can I capture with HookSense?: Any Shopify webhook topic: orders/create, orders/paid, products/update, customers/create, app/uninstalled, and the mandatory GDPR webhooks. HookSense captures the full payload and headers so you can inspect every field before writing your handler.

Test webhooks from other providers

Start testing Shopify webhooks now

Free plan includes 100 requests/day, 7-day retention, real-time streaming. No credit card.

Create a free endpoint