Agent skill · security · jeremylongshore
shopify-security-basics
Apply Shopify security best practices for API credentials, webhook HMAC
Why this skill is useful
Provides specific security practices and implementation details for securing Shopify API credentials and validating webhooks that the AI wouldn't reliably generate on its own.
What it needs
Requires shopify account access. About 3k tokens when loaded. Last updated 2026-08-07. 2,604 stars on the source repository.
What this skill does
Shopify Security Basics Overview Security essentials for Shopify apps: credential management, webhook HMAC validation, request verification, and least-privilege access scopes. Prerequisites Shopify Partner account with app credentials Understanding of HMAC-SHA256 signatures Access to Shopify app configuration Instructions Step 1: Secure Credential Storage Token format reference: Token Type Prefix Length Used For ----------- -------- -------- ---------- Admin API access token shpat 38 chars Server-side Admin API Storefront API token varies varies Client-safe storefront queries API secret key none 32+ hex Webhook HMAC, OAuth Step 2: Webhook HMAC Verification Shopify signs every webhook with your app's API secret using HMAC-SHA256. The signature is in the X-Shopify-Hmac-Sha256 header. Use crypto.timingSafeEqual for comparison to prevent timing attacks. The middleware must use raw body parser (not JSON parser). See Webhook HMAC Verification for the complete implementation. Step 3: OAuth Request Verification Verify that incoming OAuth requests from Shopify are authentic by checking the HMAC query parameter. The library handles this automatically, but the manual approach sorts params alphabetically, creates a query string, and compares HMAC hex digests. See OAuth Request Verification for the complete implementation. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills jeremylongshore/shopify-security-basics