# Empty x-shiphero-hmac-sha256 webhook signature **URL:** \ **Category:** GraphQL API\ **Created:** [May 15, 2026, 4:24pm UTC](https://community.shiphero.com/t/empty-x-shiphero-hmac-sha256-webhook-signature/3688 "2026-05-15T16:24:42Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![sgriffin](https://avatars.discourse-cdn.com/v4/letter/s/bc8723/32.png) [@sgriffin](https://community.shiphero.com/u/sgriffin)\ **Post date:** [May 15, 2026, 4:24pm UTC](https://community.shiphero.com/t/empty-x-shiphero-hmac-sha256-webhook-signature/3688/1 "2026-05-15T16:24:42Z")
Hi, I’m hitting the same issue as this thread: [Webhook has empty x-shiphero-hmac-sha256 signature](https://community.shiphero.com/t/webhook-has-empty-x-shiphero-hmac-sha256-signature/3324) . PO Update and other webhooks on the same account sign fine. Tried re-registering under both the 3PL and customer accounts, with and without `customer_account_id`. No change. Can someone from ShipHero confirm if this is a known bug on Order Canceled, and what the recommended verification approach is in the meantime? Thanks in advance, ---
**Author:** ![kevchcm](https://avatars.discourse-cdn.com/v4/letter/k/3da27b/32.png) [@kevchcm](https://community.shiphero.com/u/kevchcm)\ **Post date:** [May 15, 2026, 4:44pm UTC](https://community.shiphero.com/t/empty-x-shiphero-hmac-sha256-webhook-signature/3688/2 "2026-05-15T16:44:29Z")
I’m the OP of the thread you linked. I had to use the **user\_agent** as a validation method to verify that the request is coming from Ship Hero. ---
**Author:** ![sgriffin](https://avatars.discourse-cdn.com/v4/letter/s/bc8723/32.png) [@sgriffin](https://community.shiphero.com/u/sgriffin)\ **Post date:** [May 15, 2026, 6:00pm UTC](https://community.shiphero.com/t/empty-x-shiphero-hmac-sha256-webhook-signature/3688/3 "2026-05-15T18:00:14Z")
Thanks @kevchcm, greatly appreciate your response! I will definitely consider using that as an initial filter. I do hope that ShipHero responds to this matter because the absence of the hmac signature still leaves us vulnerable to spoofing, especially when dealing with a webhook that signals order cancellations. ---
**Author:** ![maxorona](https://avatars.discourse-cdn.com/v4/letter/m/e0b2c6/32.png) [@maxorona](https://community.shiphero.com/u/maxorona)\ **Post date:** [May 28, 2026, 6:49pm UTC](https://community.shiphero.com/t/empty-x-shiphero-hmac-sha256-webhook-signature/3688/4 "2026-05-28T18:49:25Z")
The problem here lies on the mismatch between the shop\_name that comes on the order and the shop\_name used when the webhook was registered. If order doesn’t include a shop\_name, the webhook will compute the HMAC-SHA256 using the shop\_name it was given when it was registered. But if order comes with a shop\_name, webhook will look for an entry on API settings containing that shop\_name. If it doesn’t find that, it won’t compute the HMAC digest. So the workaround here will be the create an API credential for the shop\_name that comes on orders. ---
**Author:** ![jjconti](https://avatars.discourse-cdn.com/v4/letter/j/bcef8e/32.png) [@jjconti](https://community.shiphero.com/u/jjconti)\ **Post date:** [July 1, 2026, 6:59pm UTC](https://community.shiphero.com/t/empty-x-shiphero-hmac-sha256-webhook-signature/3688/5 "2026-07-01T18:59:22Z")
Hi @sgriffin, thanks for raising this, and thanks @kevchcm for sharing the workaround. I would not recommend using the User-Agent as the primary verification method. It can be useful as an extra coarse filter, but the HMAC signature is the right mechanism for verifying that the webhook came from ShipHero. For the Order Canceled webhook specifically, the signature is generated using API credentials that match the order’s `shop_name` for that account, with fallback to `default` credentials when available. If the webhook was registered under one `shop_name`, but the canceled order has a different `shop_name` and there is no API credential/secret for that shop, the webhook may be delivered without the `X-Shiphero-HMAC-SHA256` header. The recommended fix is to create API credentials for the same `shop_name` that appears on the order / webhook payload, then register the Order Canceled webhook for that shop. After that, the HMAC header should be included. ---
**Author:** ![system](https://us1.discourse-cdn.com/flex020/uploads/shiphero/original/2X/8/83f2a5ec5d7908b156cb6999baa4c753fadfa85d.svg) [@system](https://community.shiphero.com/u/system)\ **Post date:** [September 29, 2026, 6:59pm UTC](https://community.shiphero.com/t/empty-x-shiphero-hmac-sha256-webhook-signature/3688/6 "2026-09-29T18:59:37Z")
This topic was automatically closed 90 days after the last reply. New replies are no longer allowed.