Security Practices

List of security practices for usage of webhooks

• Serve your webhook URL over HTTPS only (enforced on create and update).
• Verify X-Webhook-Signature on every request before trusting the body.
• Store api_secret and webhook signing secrets in a secrets manager — never in frontend code.
• Reject unknown X-Webhook-Id values and unexpected X-Shop-Hash values.
• Treat delivery as idempotent — retries can occur.
• Use rotate-secret if a signing secret may have leaked.
• Authenticate with your developer access token — never reuse merchant browser JWTs.