Devlog

store-integrations.md — VIEW

$ cat ~/devlog/store-integrations.md

Wiring Shopify into everything else

6 min readWebhooksAdmin APIERP
fig.2 — orders leaving the building
fig.2 — orders leaving the building

Integrations fail quietly: a missed webhook, a duplicate order, a rate limit at peak. Good ones are boring because they are built for those days.

Webhooks first, polling last

Subscribe to orders/create, products/update and friends instead of asking every minute. Polling burns API budget and is always late.

Trust nothing that arrives

Every webhook carries an X-Shopify-Hmac-Sha256 header. Verify it against the raw body before you parse a single field.

webhooks/verify.ts
import crypto from "node:crypto";

export function verify(rawBody: Buffer, hmac: string, secret: string) {
  const digest = crypto.createHmac("sha256", secret)
    .update(rawBody).digest("base64");
  return crypto.timingSafeEqual(Buffer.from(digest), Buffer.from(hmac));
}

Make every handler idempotent

  • Shopify retries — the same event can arrive twice.
  • Store the webhook id, skip anything already processed.
  • Queue the work, answer 200 fast.

-- EOF --