Shopify app creation feels finished the moment your app installs and loads in the admin. Then review sends it back because your webhook endpoint accepted a forged request, or your three mandatory GDPR compliance webhooks do nothing. This walkthrough fixes both in a Node.js custom app: verify the HMAC against the raw body, answer fast and process later, and write real handlers for customers/data_request , customers/redact and shop/redact .

If your logs say "HMAC verification failed" while the secret is definitely correct, this is for you.

Why does HMAC verification fail even with the right secret?

Almost always because you are hashing the wrong bytes. Shopify signs the exact raw request body, and express.json() has already parsed it into an object by the time your handler runs.

Shopify computes an HMAC-SHA256 of the body with your app's client secret, base64-encodes it and sends it in the X-Shopify-Hmac-Sha256 header.…