Authentication

Authentication is checked before an event is validated, transformed, or delivered to Shopify Flow. Secrets are encrypted at rest.

None

Use None only for sources that cannot send credentials and only when the event does not expose sensitive actions. Hooklane accepts the request without checking a header.

Bearer Token

Set a secret token in Hooklane and send it in the standard Authorization header.

Authorization: Bearer your-secret-token

The scheme must be Bearer; the token is compared without logging its value.

HMAC-SHA256

Use this for providers that sign the exact raw request body. Choose the header name, secret, and output encoding (hex or base64) in Hooklane. Hooklane calculates HMAC-SHA256(raw body, secret) and compares it to the header value.

X-Hub-Signature-256: sha256=4f815f...

The optional sha256= prefix is accepted. For a provider that sends Base64 signatures, select Base64 encoding instead.

JWT (HS256)

Use a JSON Web Token signed with HS256. The signed token must be sent as a bearer token. Hooklane validates the signature and respects the exp and nbf claims, allowing a small clock skew.

Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...

{ "alg": "HS256", "typ": "JWT" }

Dual Key rotation

Dual Key accepts either a primary or secondary bearer token. It lets you rotate a secret without downtime: add a new secondary key, update the sender, then promote it after traffic has moved.

Authorization: Bearer primary-or-secondary-token

Hooklane records which key succeeded so you can confirm it is safe to finish the rotation.