| name | shopline-webhooks |
| description | Receive and verify SHOPLINE webhooks. Use when setting up SHOPLINE webhook handlers, debugging X-Shopline-Hmac-Sha256 signature verification, or handling store events like orders/create, products/update, or collect/delete.
|
| license | MIT |
| metadata | {"author":"hookdeck","version":"0.1.0","repository":"https://github.com/hookdeck/webhook-skills"} |
SHOPLINE Webhooks
When to Use This Skill
- How do I receive SHOPLINE webhooks?
- How do I verify SHOPLINE webhook signatures (
X-Shopline-Hmac-Sha256)?
- How do I handle
orders/create, products/update, or collect/delete events?
- Why is my SHOPLINE webhook signature verification failing?
Verification (core)
SHOPLINE (the SHOPLINE Open Platform, developer.shopline.com) signs every
webhook with HMAC-SHA256 of the raw request body keyed on your app
secret (Developer Center → App credentials) and sends the digest in the
X-Shopline-Hmac-Sha256 header. Use the raw body — parsing JSON first
changes the bytes and breaks the signature — and compare timing-safe.
Encoding — verified as lowercase hex. SHOPLINE's docs show a base64
digest in the header example (Shopify-style), while a code sample shows .
A live delivery settles it: the code sample is right. Confirmed against a real
webhook (API version ) by recomputing
HMAC-SHA256 over the raw body with the app secret — the header was 64 lowercase
hex characters and matched exactly.
