Carted commented on Help with verifying a webhook came from Shopfiy

You can only verify webhooks if they are created with an app and not through the admin panel. If you want to verify webhooks coming from the admin panel you can be creative and use a unique url such as http://yourdomain.com/MjsstbgRYVjXvjl1ybV4HkchrHESDNXKVHU6CLHTQ4W2NO4rq7KsfRAZnGZf32OI that way you know there is no chance anybody can guess the url and send a fake request.