Introduction When designing modern, distributed systems—especially cloud-hosted microservices—choosing the right messaging backbone is critical. Two of the most popular options are RabbitMQ and Apache Kafka. While both enable asynchronous communication, they were built for different use cases.
Month: December 2025
Architectural Option Analysis: Securing Data Flow from Shopify Webhooks to an API Behind Kong Gateway
When integrating Shopify webhooks with an internal API protected by the Kong API Gateway, one of the first—and most critical—challenges you’ll encounter is authentication. Shopify signs its webhook payloads using an HMAC-SHA256 signature, which is delivered in a custom HTTP header (x-shopify-hmac-sha256). Unfortunately, this doesn’t align neatly with standard authentication mechanisms, especially those built into…
How to Validate the HMAC Hash in Kong Gateway for Shopify Webhooks
When integrating Shopify webhooks with Kong Gateway, one common challenge is validating the HMAC signature provided by Shopify. At the time of writing, there is no built-in Kong plugin that can directly read and validate the HMAC value passed in the X-Shopify-Hmac-Sha256 header. Shopify does not allow customizing this header to use Kong’s standard HMAC…