Shopify webhook HMAC metafield blank? Prove signature verify, topic payload, and one metafield write.

Use this page when Shopify delivers the topic but the metafield never updates because HMAC fails, the body was parsed before verify, or the write never runs after a valid signature. If the miss is webhook registration or topic selection without an HMAC gate, use webhook metafield blank. If the miss is only inside an embedded Admin session-token fetch, use session token metafield missing.

Do not rotate the client secret yet. Capture the shop, app, topic, delivery id, HMAC header presence, whether verify uses the raw body, resource id from the payload, namespace.key, and whether any metafield write runs after a passing verify.

Open Settings → Custom data and confirm the definition is owned by the resource the webhook should update (Product, Shop, Order, or Customer). Record the exact namespace and key, for example ops.webhook_hmac_note, the type, and whether the app owns the definition.

Open that exact resource in Admin. Save a short unmistakable test value manually, refresh, and confirm it survives. A filled Admin value with no post-HMAC write path is not proof the webhook handler can update it.

Shopify signs the raw request body with the app client secret. Verifying after JSON.parse, after middleware that re-encodes the body, or against the wrong secret fails even when the delivery is genuine. Confirm the header is X-Shopify-Hmac-Sha256, base64-compare the digest, and reject before any Admin API write.

Log verify pass/fail and topic without logging the secret or full payload PII. If verify always fails, fix body buffering and secret selection before debugging metafield GraphQL. If verify passes but the metafield stays blank, the write path—not HMAC—is the bug.

After HMAC passes, confirm the handler reads the correct resource id from the topic payload, authenticates with an offline or appropriate Admin session, and writes metafieldsSet (or REST equivalent) for the exact namespace.key. A handler that returns 200 without writing will look “healthy” in webhook logs while the metafield stays blank.

Keep the diagnosis distinct from webhook subscription metafield blank and Admin GraphQL metafield missing. Those can look similar while failing on registration or query selection instead of HMAC-gated writes.

Use one resource and one topic delivery. Record topic, delivery id, HMAC verify result, raw-body handling note, payload resource id, namespace.key, Admin API write response, and whether Admin shows the new value. Replay only after fixing verify or write — not by reinstalling the app first.

If the field is still blank, classify it as definition/value, HMAC/body mismatch, wrong secret, missing write after pass, wrong owner id, or scope failure on write. Do not rotate secrets until one live delivery proves verify and write on a single resource.

Stay DIY when one raw-body HMAC fix, secret alignment, or post-verify metafield write explains the blank. Keep the proof packet so future webhook topics stay gated and write-proven.

Pay for the $997 one-time install when several Shopify surfaces, apps, catalogs, and ops alerts need to be wired and documented on one live store. Nico at Latch AI Ops can connect the agreed workflow in a 72-hour window after collaborator access. No earnings claim, conversion guarantee, or theme rebuild is included; owner passwords are not requested.