How to verify shopify webhook?

@herminia_bruen 

To verify a Shopify webhook, you can use the following steps:

1. Get the webhook request headers: When a webhook is triggered, a POST request is sent to the specified endpoint URL. You can access the headers of this request to verify the authenticity of the webhook.
2. Retrieve the X-Shopify-Hmac-SHA256 header: Shopify includes a special header called X-Shopify-Hmac-SHA256 in each webhook request. This header contains a base64-encoded HMAC-SHA256 hash of the request payload using your webhook secret key as the encryption key.
3. Calculate the HMAC-SHA256 hash locally: Use the same webhook secret key and the payload of the incoming request to calculate the HMAC-SHA256 hash. You can use tools like OpenSSL or online HMAC generators to create the hash.
4. Compare the calculated hash with the received hash: Compare the calculated hash with the value of the X-Shopify-Hmac-SHA256 header in the incoming webhook request. If the two values match, then the webhook request is verified and can be trusted.

By following these steps, you can ensure that the incoming webhook requests are authentic and have not been tampered with during transmission. This helps prevent unauthorized access to your Shopify store and ensures the security of your data.