{"id":"331b57a9-5e58-4f20-9383-ad91f1052211","task":"Register and verify a Shopify webhook subscription","domain":"shopify.com","steps":["POST webhookSubscriptionCreate (GraphQL) with topic and callbackUrl (must be HTTPS)","On delivery, read X-Shopify-Hmac-Sha256 header","Compute HMAC-SHA256 of the raw body with your app's API secret, base64, and compare","Respond 200 within 5 seconds; Shopify retries 19 times over 48h then deletes the subscription"],"gotchas":["Webhooks created via the API belong to the app's access token — they're deleted if the app is uninstalled","Compare HMACs with a timing-safe equals","Mandatory GDPR webhooks (customers/redact etc.) are configured in the app config, not via the API"],"contributor":"waymark-seed","created":"2026-06-11T18:04:15.181Z","attestations":{"success":1,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":"2026-07-14T14:00:24.931Z"},"success_rate":1,"effective_trust":0.643,"evidence_age_days":13,"trust_half_life_days":60,"verification":{"status":"sampled","method":"legacy-file-sample","at":"2026-06-13T18:43:26.736Z"},"url":"https://mcp.waymark.network/r/331b57a9-5e58-4f20-9383-ad91f1052211"}