shiphero-webhooks

ShipHero Webhooks

When to Use This Skill

• How do I receive ShipHero webhooks?
• How do I verify ShipHero webhook signatures?
• How do I handle Order Allocated, Shipment Update, or Inventory Update events?
• Why is my ShipHero webhook signature verification failing?
• How do I register a ShipHero webhook with the webhook_create mutation?

Verification (core)

ShipHero signs each webhook with HMAC-SHA256 over the raw JSON request body, base64-encoded, sent in the x-shiphero-hmac-sha256 header. The key is the app's shared_signature_secret, returned once by the webhook_create mutation. Verify by recomputing base64(HMAC-SHA256(rawBody, secret)) and comparing timing-safe against the header. Pass the raw body — parsing JSON first will break the signature. This is a plain HMAC of the raw body (NOT payload-concatenated-with-account-id, NOT Standard Webhooks).

There is no topic header — dispatch on the webhook_type field inside the (verified) payload. X-Shiphero-Message-ID is a unique per-delivery id for deduplication.

Node:

const crypto = require('crypto');

function verifyShipHeroWebhook(rawBody, hmacHeader, secret) {
  if (!hmacHeader) return false;
  const expected = crypto.createHmac('sha256', secret).update(rawBody).digest('base64');
  try {
    return crypto.timingSafeEqual(Buffer.from(expected), Buffer.from(hmacHeader));
  } catch {
    return false;
  }
}

Python:

import hmac, hashlib, base64

def verify_shiphero_webhook(raw_body: bytes, hmac_header: str, secret: str) -> bool:
    if not hmac_header:
        return False
    expected = base64.b64encode(
        hmac.new(secret.encode(), raw_body, hashlib.sha256).digest()
    ).decode()
    return hmac.compare_digest(expected, hmac_header)

Respond quickly: ShipHero uses a ~10s timeout (20s for Generate Label) and retries up to 5 times per trigger. Respond 2xx with body {"code": "200", "Status": "Success"} and process work asynchronously if slow. Note: ShipHero does not queue events while a webhook is disabled — they are discarded.