shopline-webhooks

name	shopline-webhooks
description	Receive and verify SHOPLINE webhooks. Use when setting up SHOPLINE webhook handlers, debugging X-Shopline-Hmac-Sha256 signature verification, or handling store events like orders/create, products/update, or collect/delete.
license	MIT
metadata	{"author":"hookdeck","version":"0.1.0","repository":"https://github.com/hookdeck/webhook-skills"}

SHOPLINE Webhooks

When to Use This Skill

• How do I receive SHOPLINE webhooks?
• How do I verify SHOPLINE webhook signatures (X-Shopline-Hmac-Sha256)?
• How do I handle orders/create, products/update, or collect/delete events?
• Why is my SHOPLINE webhook signature verification failing?

Verification (core)

SHOPLINE (the SHOPLINE Open Platform, developer.shopline.com) signs every webhook with HMAC-SHA256 of the raw request body keyed on your app secret (Developer Center → App credentials) and sends the digest in the X-Shopline-Hmac-Sha256 header. Use the raw body — parsing JSON first changes the bytes and breaks the signature — and compare timing-safe.

Encoding — verified as lowercase hex. SHOPLINE's docs show a base64 digest in the header example (Shopify-style), while a code sample shows . A live delivery settles it: the code sample is right. Confirmed against a real webhook (API version ) by recomputing HMAC-SHA256 over the raw body with the app secret — the header was 64 lowercase hex characters and matched exactly.