shopify-security-basics

# Shopify Security Basics ## Overview Security essentials for Shopify apps: credential management, webhook HMAC validation, request verification, and least-privilege access scopes. ## Prerequisites - Shopify Partner account with app credentials - Understanding of HMAC-SHA256 signatures - Access to Shopify app configuration ## Instructions ### Step 1: Secure Credential Storage ```bash # .env — NEVER commit SHOPIFY_API_KEY=your_api_key SHOPIFY_API_SECRET=your_api_secret_key SHOPIFY_ACCESS_TOKEN=shpat_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx # .gitignore — add immediately .env .env.local .env.*.local *.pem ``` **Token format reference:** | Token Type | Prefix | Length | Used For | |-----------|--------|--------|----------| | Admin API access token | `shpat_` | 38 chars | Server-side Admin API | | Storefront API token | varies | varies | Client-safe storefront queries | | API secret key | none | 32+ hex | Webhook HMAC, OAuth | ### Step 2: Webhook HMAC Verification Shopify signs every webhook with your app's API secret using HMAC-SHA256. The signature is in the `X-Shopify-Hmac-Sha256` header. ```typescript import crypto from "crypto"; import express from "express"; function verifyShopifyWebhook( rawBody: Buffer, hmacHeader: string, secret: string ): boolean { const computed = crypto .createHmac("sha256", secret) .update(rawBody) .digest("base64"); // Timing-safe comparison prevents timing attacks return crypto.timingSafeEqual( Buffer.from(computed...