---
title: "Connect Slack webhooks to Shopify Flow - Workflow Webhooks"
description: "Send Slack webhooks into Shopify Flow. Step-by-step setup with Slack's HMAC signature verified on every request, plus what the app checks and how to troubleshoot."
canonical: "https://docs.workflow-webhooks.app/how-to-connect-slack"
---

# How to connect Slack to Shopify Flow

Slack signs every request it sends to your app - slash commands, interactive messages and Events API deliveries - with your app's signing secret. **Workflow Webhooks** turns that call into a **Shopify Flow trigger**, so your store can react to it: tag a customer, add an order note, send an internal email, update a metafield - anything Shopify Flow can do.

This guide sets up the whole path - Slack sends, Workflow Webhooks receives and verifies, Shopify Flow acts - with Slack's HMAC signature checked on every request, so nothing but Slack can start your workflow.

## What you can build

- Let your team fire a Shopify Flow workflow from Slack with a slash command, without giving anyone admin access.
- Approve something in Slack and have Flow tag the order or customer that was approved.
- Turn a Slack shortcut into a store action - add a tag, send an email, update a metafield.

Typical events to send: a slash command such as `/restock`, a button press on an interactive message, an Events API event.

## Before you begin

- **Workflow Webhooks** installed on your Shopify store.
- **Shopify Flow** installed, which is free from the Shopify App Store.
- An account on Slack with permission to create webhooks.

## Step 1 - Create the webhook in Workflow Webhooks

1. Open **Workflow Webhooks -> Webhooks -> Create webhook** and give it a name you will recognise in Flow, such as `Slack events`.
2. Under **Authentication**, choose **HMAC**.
3. Under **Signature provider**, pick **Slack**. The app fills in the header, algorithm, signed payload and replay window for you - there is nothing else to configure.
4. Leave the secret empty for now and **Save**. Copy the webhook URL shown on the page.

See [Authentication](https://docs.workflow-webhooks.app/authentication.md) for the other authentication modes, and [Payload mapping and Flow variables](https://docs.workflow-webhooks.app/payload-mapping.md) for choosing which fields reach Flow.

## Step 2 - Add the endpoint in Slack

In your Slack app configuration, add the URL as the Request URL for the slash command, interactivity or Events API, and copy the **Signing Secret** from **Basic Information -> App Credentials**.

### How to find your Slack signing secret

Slack app Signing Secret (Basic Information -> App Credentials).

[Slack's own documentation on webhook signatures](https://docs.slack.dev/authentication/verifying-requests-from-slack) has the exact wording and screenshots for your account.

Paste that secret into the webhook's **Secret** field in Workflow Webhooks and save. From that moment every Slack delivery is verified before it reaches Flow.

## What this checks

| What | Value |
| --- | --- |
| **Signature header** | `X-Slack-Signature` |
| **Where the signature sits** | The header value, after the prefix `v0=` |
| **What is signed** | `v0:{timestamp}:{body}` |
| **Signature** | HMAC-SHA256, hex encoded |
| **Timestamp** | The `X-Slack-Request-Timestamp` header, as Unix seconds |
| **Replay protection** | Requests whose signed timestamp is more than 5 minutes away from now are rejected |
| **The secret** | Used as plain text. Paste it exactly as the sender shows it |

In the signed payload, `{body}` is the raw request body, byte for byte, and `{timestamp}` is the timestamp above.

A request that fails any of these is rejected with `401`, is recorded in [History and troubleshooting](https://docs.workflow-webhooks.app/history-and-troubleshooting.md), and never starts a workflow.

> [!WARNING]
> **Worth knowing about Slack**
> Slash commands and interactivity work as is. The Events API first sends a url_verification challenge that must be echoed back: answer it with a transform function (ctx.respond) or verify the URL before switching this on.

## Step 3 - Build the Shopify Flow workflow

1. In **Shopify Flow**, create a workflow and choose the **Workflow Webhooks** trigger.
2. Press **Record events**, then send a test event from Slack (or use **Send test** in Workflow Webhooks) so Flow learns the shape of your data.
3. Every webhook you own fires the same Flow trigger, so add a first condition on the **webhook id** to keep this workflow to Slack only. The id is shown on the webhook page.
4. Add your actions - tag a customer, add a note, send an internal email, update a metafield.

## Step 4 - Test it end to end

Trigger a real event in Slack. In **Workflow Webhooks -> History** you should see the invocation with status **Success**. If the signature was wrong you get a failed entry with the reason instead, and [Verifying signed webhooks](https://docs.workflow-webhooks.app/signature-verification.md) explains the signature tester that shows you exactly which step failed.

### The signature does not match

In this order: the **secret** (the most common cause - an extra space, or a key from the wrong environment), whether the sender is using a **different endpoint's** secret, and whether anything between Slack and the app **rewrites the body**. Signatures cover the raw bytes, so a proxy that re-formats JSON breaks them. The signature tester on the webhook page shows the exact text that was signed.

### I get 401 on every request

Check that the webhook's authentication is set to **HMAC** with the **Slack** provider selected, that the secret is filled in, and that Slack is posting to the URL exactly as the app shows it, including the code at the end.

### Nothing appears in History

The request never arrived. Re-check the URL in Slack, and look at Slack's own delivery log for the response it got. A `404` means a wrong or deleted webhook, a `429` means you are over your plan's invocation limit - see [Plans and usage](https://docs.workflow-webhooks.app/plans-and-usage.md).

### The workflow runs for the wrong events

Every webhook in your store fires the same Flow trigger. Add a condition on the **webhook id** as the first step of the workflow, or narrow the events you send from Slack.

### Requests fail with "timestamp outside tolerance"

Slack signs a timestamp and the app rejects anything more than 5 minutes old. This is normally a clock problem on the sending side, or a delivery that Slack retried much later with the original timestamp. Retries from the same original request cannot pass; ask Slack to send a fresh event.

## Related

- [Verifying signed webhooks](https://docs.workflow-webhooks.app/signature-verification.md) - every provider we verify, and how to describe one we do not.
- [Payload mapping and Flow variables](https://docs.workflow-webhooks.app/payload-mapping.md) - getting the right fields out of the payload and into Flow.
- [Duplicate delivery protection](https://docs.workflow-webhooks.app/duplicate-delivery.md) - what happens when Slack retries a delivery.
- [History and troubleshooting](https://docs.workflow-webhooks.app/history-and-troubleshooting.md) - the log of every request, with replay.