webhook.process validation fails in custom apps

[SuperKXT]

Issue summary

The HMAC sent in the HTTP webhook header validates against the passed apiSecretKey. In a custom app, the documentation indicates using the shared secret instead.
This is the relevant line.

shopify-api-js/lib/webhooks/process.ts

Line 53 in 2e01ac6

if (await validateOkWebhook(config.apiSecretKey, rawBody, hmac)) {

• @shopify/shopify-api version: 6.2.0
• Node version: 19.7.0
• Operating system: Pop!_OS 22.04 LTS x86_64

Expected behavior

webhook.process should validate the HMAC correctly

Actual behavior

webhook validation fails.
I'm side-stepping the issue by manually setting apiSecretKey to the sharedSecret just before validation. This works but feels like an unnecessary hack.

SHOPIFY.config.apiSecretKey = CONFIG.shopify.sharedSecret;
await SHOPIFY.webhooks
	.process({
		rawBody: request.body,
		rawRequest: request,
		rawResponse: response,
	})
	.catch((error) => {
		LOGGER.error(`Error in webhook handler: ${getErrorMessage(error)}`);
	})
	.finally(() => {
		SHOPIFY.config.apiSecretKey = CONFIG.shopify.accessToken;
	});

[mkevinosullivan]

For a store-specific custom app (which I think you're referring to here), the apiSecretKey should be set to the API Admin Access Token ... is this what you're referring to as the shared secret?

https://github.com/Shopify/shopify-api-js/blob/main/docs/guides/custom-store-app.md

[SuperKXT]

I have used the accessToken as the apiSecretKey. The issue is with webhook validation, where you're supposed to use the shared secret for webhooks registered from the application.
https://community.shopify.com/c/shopify-apis-and-sdks/webhooks-difference-between-shared-secret-and-signature-string/td-p/1243740

[lynndylanhurley]

We're having the same issue.

@SuperKXT thank you for sharing your hack. I can confirm that when using the hack, everything works as expected.

[aidantjones]

Same issue here. I initially tried passing a custom config object to the process method, but the code is set to use the config object attached to the shopify library object. I didn't think to reset the values there. So, yes @SuperKXT 's solution worked great. Thank you!

I spent half a day getting to this point, though. This issue seems like a major oversight. This is my first time using this library, so forgive me if I'm missing something. But I'm not sure how webhooks were validated with private apps in the past few years within this library since it's currently impossible to input the shared secret into the process method.