python - How to verify Shopify webhook in Django?

Solution:

Set these two variables in thesettings.py file

# settings.py

SHOPIFY_HMAC_HEADER = "HTTP_X_SHOPIFY_HMAC_SHA256"
SHOPIFY_API_SECRET = "5f6b6_my_secret"
Copy code

Then, create a verify webhook function that accepts the Django request as it's parameter

# utils.py

import base64
import hashlib
import hmac

from django.conf import settings
from django.core.handlers.wsgi import WSGIRequest


def verify_shopify_webhook(request: WSGIRequest):
    shopify_hmac_header = request.META.get(settings.SHOPIFY_HMAC_HEADER)
    encoded_secret = settings.SHOPIFY_API_SECRET.encode("utf-8")
    digest = hmac.new(
        encoded_secret,
        request.body,
        digestmod=hashlib.sha256,
    ).digest()
    computed_hmac = base64.b64encode(digest)
    return hmac.compare_digest(computed_hmac, shopify_hmac_header.encode("utf-8"))
Copy code

Then, create a view that accepts the incoming webhook and use theverify_shopify_webhook(...) function to verify the request.

# views.py

from django.http import HttpResponse
from django.utils.decorators import method_decorator
from django.views import View
from django.views.decorators.csrf import csrf_exempt

from .utils import verify_shopify_webhook


@method_decorator(csrf_exempt, name="dispatch")
class ShopifyWebhookView(View):
    def post(self, request, *args, **kwargs):
        verified = verify_shopify_webhook(request=request)
        return HttpResponse(status=200 if verified else 403)
Copy code

If you're using Django REST Framework (https://www.django-rest-framework.org/), you can also use APIView as

# views.py

from rest_framework.views import APIView
from rest_framework.response import Response

from .utils import verify_shopify_webhook


class ShopifyWebhookView(APIView):
    def post(self, request, *args, **kwargs):
        verified = verify_shopify_webhook(request=request)
        return Response(status=200 if verified else 403)
Copy code

Didn't find the answer?

Our community is visited by hundreds of Shopify development professionals every day. Ask your question and get a quick answer for free.