Could not validate webhook HMAC. about shopify-app-template-php HOT 4 CLOSED

Hi @paulomarg I couldn't understand the reason why the key used during the test notification will be different.

However, what I understood from your response is that ideally if the order was created from the development store, it should have validated. And, based on this understanding, I did create a few orders through the Bogus payment gateway. However, even then the validation is failing.

However, when I looked at the sample codes on shopify dev docs: https://shopify.dev/apps/webhooks/configuration/https#step-5-verify-the-webhook

In the PHP code, verify_webhook function uses "hash_equals" function rather than the !== on line 282
https://github.com/Shopify/shopify-api-php/blob/main/src/Webhooks/Registry.php#L282

So, I am a bit confused where I am getting this wrong. A little bit of help in this would be very helpful.

from shopify-app-template-php.

Hi @katielgc, unfortunately, that feature for manually dispatching a webhook call won't work with apps. Because it's a store feature, it will create an HMAC signature using that key you mentioned, rather than the app's secret key (which is what the app would expect).

In order to be able to test your app webhook for order creation, you'd need to create an order in your development store, and Shopify will automatically fire the webhook to your app.

Since this is not a bug in the library code, I'm closing the issue, but please feel free to open a new issue if you have any further problems.

from shopify-app-template-php.

Thanks @paulomarg for your quick response I see what you mean and appreciate you letting me know 🥇

from shopify-app-template-php.

Hi @paulomarg I couldn't understand the reason why the key used during the test notification will be different.

However, what I understood from your response is that ideally if the order was created from the development store, it should have validated. And, based on this understanding, I did create a few orders through the Bogus payment gateway. However, even then the validation is failing.

However, when I looked at the sample codes on shopify dev docs: https://shopify.dev/apps/webhooks/configuration/https#step-5-verify-the-webhook

In the PHP code, verify_webhook function uses "hash_equals" function rather than the !== on line 282 https://github.com/Shopify/shopify-api-php/blob/main/src/Webhooks/Registry.php#L282

So, I am a bit confused where I am getting this wrong. A little bit of help in this would be very helpful.

you can find in .myshopify.com/admin/settings/notifications page under Webhooks section that says "All your webhooks will be signed with <key> so you can verify their identity."

You can use key as API_SECRET_KEY to validate HMAC

from shopify-app-template-php.