Test Shopify Webhooks in Development

Setup

# Terminal 1
shopify app dev
# or: npm run dev

# Terminal 2
npx localtolink --port 3000

Register webhook URL

In Shopify Partners → Your App → Configuration → Webhooks (or via Admin API):

https://YOUR-SUBDOMAIN.localtolink.com/webhooks/shopify

For Shopify CLI apps, you may also configure the tunnel URL in shopify.app.toml depending on your app setup.

Verify HMAC

Shopify signs webhooks with HMAC-SHA256. Verify using your app's client secret:

import crypto from "crypto";

function verifyShopifyWebhook(rawBody, hmacHeader, secret) {
  const hash = crypto
    .createHmac("sha256", secret)
    .update(rawBody, "utf8")
    .digest("base64");
  return crypto.timingSafeEqual(Buffer.from(hash), Buffer.from(hmacHeader));
}

OAuth + webhooks together

If your app uses OAuth, register the tunnel URL for both:

Redirect URI: https://YOUR-SUBDOMAIN.localtolink.com/auth/callback
Webhook URL: https://YOUR-SUBDOMAIN.localtolink.com/webhooks/shopify

See OAuth Callback on Localhost for redirect URI details.

Notes

Webhook POSTs bypass the browser interstitial
Update URLs when subdomain changes (new session)
2-hour session limit
No request replay — use Shopify's webhook delivery logs

See Test Webhooks Locally.

Try it now

Start a tunnel from your project directory — no account required.

$ npx localtolink

See the full CLI reference for flags and exit codes.

LocalToLink CLI 1.0.1 — verified 2026-09-05