Setup

Authenticate requests

FlowRelay authenticates incoming events before it records the receipt and hands a trigger to Shopify Flow.

Next step Continue with Event types and payloads.

Steps

Complete these in order.

Choose the sending service

Select Zapier, Make, n8n, or custom HTTP/code when creating the endpoint. This tells FlowRelay what will make the POST request; it does not change the Shopify Flow trigger variant.
Use the compatible preset

FlowRelay selects static-header authentication for Zapier, Make, and n8n, and exact-body HMAC-SHA256 for custom HTTP/code.
Override only deliberately

A capable sender may use the advanced override. Keep HMAC when the sender can calculate a digest over the exact raw request bytes; do not select it for a standard no-code webhook step that cannot do so.
Send a synthetic test

Send a test event with synthetic data and use the receipt to confirm authentication passed before connecting real production events.
Diagnose authentication failures

If authentication fails, share the FlowRelay support code or diagnostics share. Do not paste secrets, full authentication headers, signatures, or raw event bodies into support.

Choose the authentication mode #

HMAC binds authentication to the exact body bytes and remains the stronger custom-code path. Static-header authentication is the compatible normal path for Zapier, Make, and n8n. Both require a private generated secret, and the advanced override remains available for capable senders.

Mode	Use when	Operator note
HMAC-SHA256	Custom HTTP/code or another sender can sign the exact request body.	Recommended for capable senders because the digest authenticates both the shared secret and the exact body bytes.
Static-header auth	Zapier, Make, n8n, or another sender can attach a fixed secret header but cannot calculate FlowRelay's exact-body HMAC.	FlowRelay selects this automatically for the standard no-code profiles. Keep the value private and rotate it if it is exposed or the sender relationship changes.

Request wire contract #

Send JSON with POST to the endpoint URL and put authentication in that endpoint's configured header. FlowRelay compares a static value exactly or verifies a lowercase hexadecimal HMAC-SHA256 digest over the exact raw request bytes. Parsing, reformatting, re-encoding, or otherwise changing the body after signing invalidates the HMAC signature.

HMAC sender pseudocode Keep placeholders private and sign the same bytes the sender transmits.

body_bytes = utf8_encode(exact_json_body)
signature = lowercase_hex(hmac_sha256(FLOWRELAY_SIGNING_SECRET, body_bytes))
POST FLOWRELAY_ENDPOINT_URL
Content-Type: application/json
FLOWRELAY_CONFIGURED_AUTH_HEADER: signature
Body: body_bytes

Static-header synthetic request Replace placeholders only inside the sender's trusted configuration.

curl -X POST "$FLOWRELAY_ENDPOINT_URL" \
  -H "Content-Type: application/json" \
  -H "$FLOWRELAY_CONFIGURED_AUTH_HEADER: $FLOWRELAY_STATIC_SECRET" \
  --data-binary '{"event_type":"synthetic.test","external_event_id":"synthetic-001"}'

Requirement	HMAC-SHA256	Static header
Method and media type	POST with Content-Type: application/json	POST with Content-Type: application/json
Configured auth header	Put the lowercase hexadecimal SHA-256 digest in the exact header name shown for this endpoint.	Put the exact generated secret value in the exact header name shown for this endpoint.
Comparison input	HMAC the exact raw body bytes that are sent on the wire.	Compare the configured header value exactly.

Success check #

A test receipt shows that authentication passed before you enable production traffic. If authentication fails, fix the sender configuration and send a new test event with synthetic data.

Safe troubleshooting #

FLR_AUTH_HEADER_MISSING means the configured header name was absent. FLR_AUTH_FAILED means the static value or exact-body HMAC did not verify. Two newest consecutive outside authentication failures within 30 minutes can prompt a guided, non-destructive replacement endpoint; the original remains active until you separately delete it. Correct the sender configuration and send a fresh event; do not replay an unauthenticated request. Share only the support code or a diagnostics share when someone needs help. Do not share the secret, full authentication header value, signature, raw event body, Shopify token, session data, or copied merchant incident.

Handoff boundary

Delivered means FlowRelay handed the trigger to Shopify Flow. It does not mean downstream Shopify Flow branches, app calls, fulfillment changes, emails, or later systems completed.

START

USE CASES

SET UP

OPERATE

RECOVER

AGENT ACCESS

REFERENCE