How to connect Standard Webhooks to Shopify Flow

Q: The signature does not match

In this order: the secret (the most common cause - an extra space, or a key from the wrong environment), whether the sender is using a different endpoint's secret, and whether anything between Standard Webhooks and the app rewrites the body . Signatures cover the raw bytes, so a proxy that re-formats JSON breaks them. The signature tester on the webhook page shows the exact text that was signed.

Q: I get 401 on every request

Check that the webhook's authentication is set to HMAC with the Standard Webhooks provider selected, that the secret is filled in, and that Standard Webhooks is posting to the URL exactly as the app shows it, including the code at the end.

Copy page

Connect Standard Webhooks to Shopify Flow with HMAC signature verification on every request, so only trusted events trigger your workflows.

Standard Webhooks is an open specification for signing webhooks, used by OpenAI, Supabase Auth Hooks and a growing list of services. One preset covers all of them. Workflow Webhooks turns that call into a Shopify Flow trigger, so your store can react to it: tag a customer, add an order note, send an internal email, update a metafield - anything Shopify Flow can do.

This guide sets up the whole path - Standard Webhooks sends, Workflow Webhooks receives and verifies, Shopify Flow acts - with Standard Webhooks's HMAC signature checked on every request, so nothing but Standard Webhooks can start your workflow.

What you can build

Take an OpenAI webhook - a finished batch job or a completed response - and have Flow act on the result in your store.
React to a Supabase Auth Hook, so a signup in your own app tags the matching Shopify customer.
Receive from any service that follows the standardwebhooks.com spec without configuring a custom signature.

Typical events to send: any event the sending service defines.

The same preset also verifies webhooks from OpenAI, Supabase Auth Hooks.

Before you begin

Workflow Webhooks installed on your Shopify store.
Shopify Flow installed, which is free from the Shopify App Store.
An account on Standard Webhooks with permission to create webhooks.

Step 1 - Create the webhook in Workflow Webhooks

Open Workflow Webhooks -> Webhooks -> Create webhook and give it a name you will recognise in Flow, such as Standard Webhooks events.
Under Authentication, choose HMAC.
Under Signature provider, pick Standard Webhooks. The app fills in the header, algorithm, signed payload and replay window for you - there is nothing else to configure.
Leave the secret empty for now and Save. Copy the webhook URL shown on the page.

See Authentication for the other authentication modes, and Payload mapping and Flow variables for choosing which fields reach Flow.

Step 2 - Add the endpoint in Standard Webhooks

Add the URL as the endpoint in the sending service, then copy the signing secret it shows you (it starts with whsec_).

How to find your Standard Webhooks signing secret

The signing secret starting with whsec_. Paste it whole; if it is shown as v1,whsec_... (Supabase), leave out the leading "v1,".

Standard Webhooks's own documentation on webhook signatures has the exact wording and screenshots for your account.

Paste that secret into the webhook's Secret field in Workflow Webhooks and save. From that moment every Standard Webhooks delivery is verified before it reaches Flow.

What this checks

What	Value
Signature header	`webhook-signature`
Where the signature sits	The header value, after the prefix `v1,`
What is signed	`{header:webhook-id}.{timestamp}.{body}`
Signature	HMAC-SHA256, base64 encoded
Timestamp	The `webhook-timestamp` header, as Unix seconds
Replay protection	Requests whose signed timestamp is more than 5 minutes away from now are rejected
The secret	Base64-decoded before use. The leading `whsec_` is stripped before decoding. Paste it exactly as the sender shows it

In the signed payload, {body} is the raw request body, byte for byte, and {timestamp} is the timestamp above, and {header:webhook-id} is the webhook-id request header.

A request that fails any of these is rejected with 401, is recorded in History and troubleshooting, and never starts a workflow.

Step 3 - Build the Shopify Flow workflow

In Shopify Flow, create a workflow and choose the Workflow Webhooks trigger.
Press Record events, then send a test event from Standard Webhooks (or use Send test in Workflow Webhooks) so Flow learns the shape of your data.
Every webhook you own fires the same Flow trigger, so add a first condition on the webhook id to keep this workflow to Standard Webhooks only. The id is shown on the webhook page.
Add your actions - tag a customer, add a note, send an internal email, update a metafield.

Shopify Flow's Select trigger panel with Workflow Webhooks opened, listing Webhook Trigger and Sync Webhook Trigger — In Shopify Flow choose Select a trigger, open Workflow Webhooks and pick Webhook Trigger.

A Flow condition: Webhook id is equal to the ID of one webhook — The first step of every workflow: a condition on the webhook ID, so the workflow only runs for this webhook.

The finished workflow: Webhook Trigger, a condition on the webhook ID, then Send internal email on the True branch — The finished workflow: trigger, condition on the webhook ID, then your action on the True branch.

Step 4 - Test it end to end

Trigger a real event in Standard Webhooks. In Workflow Webhooks -> History you should see the invocation with status Success. If the signature was wrong you get a failed entry with the reason instead, and Verifying signed webhooks explains the signature tester that shows you exactly which step failed.

One invocation opened in History with its request headers, payload, status, duration and identifiers — A delivered event in History: status Success means Shopify Flow accepted it.

The signature does not match

In this order: the secret (the most common cause - an extra space, or a key from the wrong environment), whether the sender is using a different endpoint's secret, and whether anything between Standard Webhooks and the app rewrites the body. Signatures cover the raw bytes, so a proxy that re-formats JSON breaks them. The signature tester on the webhook page shows the exact text that was signed.

I get 401 on every request

Check that the webhook's authentication is set to HMAC with the Standard Webhooks provider selected, that the secret is filled in, and that Standard Webhooks is posting to the URL exactly as the app shows it, including the code at the end.

Nothing appears in History

The request never arrived. Re-check the URL in Standard Webhooks, and look at Standard Webhooks's own delivery log for the response it got. A 404 means a wrong or deleted webhook, a 429 means you are over your plan's invocation limit - see Plans and usage.

The workflow runs for the wrong events

Every webhook in your store fires the same Flow trigger. Add a condition on the webhook id as the first step of the workflow, or narrow the events you send from Standard Webhooks.

Requests fail with "timestamp outside tolerance"

Standard Webhooks signs a timestamp and the app rejects anything more than 5 minutes old. This is normally a clock problem on the sending side, or a delivery that Standard Webhooks retried much later with the original timestamp. Retries from the same original request cannot pass; ask Standard Webhooks to send a fresh event.

Verifying signed webhooks - every provider we verify, and how to describe one we do not.
Payload mapping and Flow variables - getting the right fields out of the payload and into Flow.
Duplicate delivery protection - what happens when Standard Webhooks retries a delivery.
History and troubleshooting - the log of every request, with replay.