← Blog Shopify July 15, 2026 · The ReDock team

Testing Shopify webhooks locally without ngrok

Shopify webhooks need a public HTTPS URL to reach your local app, here's how to receive and test them locally without wiring in ngrok.

To test Shopify webhooks locally you need one thing localhost can’t give you on its own: a public HTTPS URL that Shopify’s servers can POST to. Webhooks are inbound requests — Shopify sends order, product, and app events to a URL you register — so http://localhost:3000 is unreachable and the events go nowhere. The usual fix is ngrok; you don’t actually need it. ReDock — a free-while-in-alpha native macOS app — provides the public HTTPS tunnel as part of its Shopify app development environment, so webhooks reach your local handlers directly.

Why webhooks break on localhost

It helps to be precise about what’s happening. When your app subscribes to a webhook topic (say orders/create), Shopify stores a delivery URL. When the event fires, Shopify’s infrastructure makes an HTTPS POST to that URL from the public internet.

Your local app lives at http://localhost, which only exists on your machine. Shopify’s servers have no route to it. So the POST fails, and from your side it looks like the webhook “isn’t firing” — when really it’s firing into a wall. You need a public address that forwards to your local app.

The tunnel is the whole fix

Everything about local webhook testing comes down to exposing your app at a real, public HTTPS URL and registering that URL with Shopify:

  1. Run your app locally on the Node version it expects. ReDock reads engines.node (including a web/ subpackage) and runs it for you — the dev environment checklist covers the full setup.
  2. Expose it over HTTPS. ReDock opens a public HTTPS tunnel to your local app. That’s the piece that replaces ngrok.
  3. Register the tunnel URL as your app URL / webhook endpoint with Shopify.
  4. Trigger events and watch them arrive at your local handlers — install the app, create a test order, and confirm the POST lands.

Because the tunnel is genuine HTTPS, webhook HMAC verification and secure-context requirements behave exactly as they will in production. Shopify app development on localhost covers the whole environment.

Testing the events, not just receiving them

Once the tunnel is up, the actual testing work is straightforward:

  • Verify the signature. Shopify signs webhooks with an HMAC using your app secret. Your env needs that secret present — ReDock detects and seeds the env files your app reads, so the secret is where your handler expects it.
  • Exercise real topics. Trigger the events your app subscribes to from a development store and confirm each handler runs. Order, product, and app-lifecycle topics all POST to the same tunnel.
  • Check the session path. Webhook handlers often need to look something up; ReDock provisions a session Postgres so that path works locally too.

No part of this requires a separate tunnel service or a deployed staging copy.

Why “without ngrok” is worth it

ngrok works, but folding the tunnel into your dev environment removes a moving part. There’s no second tool to install, authenticate, and start alongside your app; the tunnel comes up with the environment. And ReDock’s tunnels have sensible lifecycle — expose while you’re testing, and the URL stops resolving when you stop sharing, so you’re not leaving an open forwarder running.

The honest scope, as always: ReDock is a Shopify app development environment for building and testing apps locally — including receiving webhooks — not a store-management tool. Shopify MCP: what agents can and can’t do covers that boundary, and the stacks docs and MCP docs cover the environment.

FAQ

Can I really test Shopify webhooks without ngrok?

Yes. You need a public HTTPS URL that forwards to your local app; ReDock provides that tunnel as part of its Shopify app dev environment, so Shopify’s webhook POSTs reach your local handlers.

Will HMAC verification work through the tunnel?

Yes. The tunnel serves real HTTPS and forwards the request intact, so the HMAC signature verifies as it would in production — provided your app secret is in your env, which ReDock seeds.

Does the webhook URL stay up when I stop working?

The tunnel is live while you’re sharing. Stop sharing and the URL stops resolving, so you don’t leave an open endpoint running. Bring the environment back up to resume testing.

Want webhooks that reach your local app without extra tools? Download ReDock to ReDock and test them today.