Webhook Skills

This repository contains webhook-related skills for AI coding agents that need to receive, verify signatures, handle events, retry deliveries, or debug webhook integrations from various providers (see Provider Webhook Skills table below).

Skills provide step-by-step instructions, signature verification code, and runnable examples for Express, Next.js, and FastAPI.

Works with Claude Code, Cursor, VS Code Copilot, and other AI coding assistants that support the Agent Skills specification.

When Should an Agent Use These Skills?

Use these webhook skills when:

  • You need to receive webhooks from third-party providers (Stripe, Shopify, GitHub, etc.)
  • You need to verify webhook signatures to ensure authenticity
  • You need to handle webhook event payloads and extract data
  • You need to implement idempotency for webhook handlers
  • You need to retry or replay failed webhook deliveries
  • You need provider-specific webhook handling logic (e.g., Stripe checkout events, GitHub push events)

Skill Discovery

These skills are designed to be discoverable by agents using skill registries and tools like find-skills, where an agent searches for webhook-related capabilities by provider or task.

Available Webhook Skills

Provider Webhook Skills

Skills for receiving and verifying webhooks from specific providers. Each includes setup guides, webhook signature verification, and runnable examples.

Provider Skill What It Does
Adyen adyen-webhooks Verify Adyen webhook HMAC signatures (additionalData.hmacSignature), handle AUTHORISATION, CAPTURE, and REFUND notifications
Akeneo akeneo-webhooks Verify Akeneo PIM Events API webhook signatures (x-akeneo-request-signature, HMAC-SHA256 hex over timestamp.body), handle batched product and product-model events like product.created, product.updated, product.removed, product_model.created, product_model.updated, and product_model.removed
Ashby ashby-webhooks Verify Ashby webhook signatures (Ashby-Signature, HMAC-SHA256 hex over the raw body), handle recruiting events like applicationSubmit, candidateHire, candidateStageChange, and interviewScheduleCreate
Alipay alipay-webhooks Verify Alipay (Antom / Alipay+) webhook signatures (Signature header, RSA256 / SHA256withRSA, base64URL over <METHOD> <URI>\n<Client-Id>.<Request-Time>.<body>), sign the acknowledgement response, handle notifyPayment, notifyCapture, notifyRefund, notifyAuthorization, and notifyDispute events
Alchemy alchemy-webhooks Verify Alchemy Notify webhook signatures (X-Alchemy-Signature, HMAC-SHA256 hex over the raw body), handle ADDRESS_ACTIVITY, MINED_TRANSACTION, DROPPED_TRANSACTION, NFT_ACTIVITY, NFT_METADATA_UPDATE, and GRAPHQL events
Asana asana-webhooks Complete the Asana X-Hook-Secret handshake, verify X-Hook-Signature (HMAC-SHA256), handle batched compact events and heartbeats
Airtable airtable-webhooks Verify Airtable webhook pings (X-Airtable-Content-MAC, HMAC-SHA256), fetch payloads with a cursor, manage 7-day webhook expiry
Airwallex airwallex-webhooks Verify Airwallex webhook signatures (x-signature / x-timestamp, HMAC-SHA256 hex over timestamp + raw body), handle payment_intent, payment_attempt, refund, payment_consent, and payment_dispute events
Attentive attentive-webhooks Verify Attentive webhook signatures (x-attentive-hmac-sha256, HMAC-SHA256 hex), handle SMS and email subscriber events
Auth0 auth0-webhooks Authenticate Auth0 Custom Log Stream deliveries (Authorization token), handle batched login and signup log events
AWS SNS aws-sns-webhooks Verify AWS SNS message signatures (RSA with SigningCertURL), confirm subscriptions, handle Notification envelopes
BigCommerce bigcommerce-webhooks Verify BigCommerce webhook callbacks (Standard Webhooks or custom headers), handle store/order and product events with API fetch-back
Bitbucket bitbucket-webhooks Verify Bitbucket webhook signatures (X-Hub-Signature, HMAC-SHA256), handle repo push and pull request events
Bridge bridge-xyz-webhooks Verify Bridge (bridge.xyz) webhook signatures (X-Webhook-Signature, RSA-SHA256 with a per-endpoint public key), handle customer, kyc_link, transfer, and virtual_account events
Calendly calendly-webhooks Verify Calendly webhook signatures (Calendly-Webhook-Signature, HMAC-SHA256 with timestamp), handle invitee.created and invitee.canceled events
Chargebee chargebee-webhooks Receive and verify Chargebee webhooks (Basic Auth), handle subscription billing events
Circle circle-webhooks Verify Circle CPN/Mint webhook signatures (X-Circle-Signature, ECDSA_SHA_256), handle payments, paymentIntents, transfers, and payouts notifications
Claude Managed Agents claude-managed-agents-webhooks Verify Anthropic Claude Managed Agents webhook signatures (X-Webhook-Signature), handle session lifecycle and outcome evaluation events
Clerk clerk-webhooks Verify Clerk webhook signatures, handle user, session, and organization events
Clio clio-webhooks Complete the Clio X-Hook-Secret handshake and verify X-Hook-Signature (HMAC-SHA256 hex), handle matter, contact, activity, and bill events
Coinbase Commerce coinbase-commerce-webhooks Verify Coinbase Commerce webhook signatures (X-CC-Webhook-Signature, HMAC-SHA256), handle charge lifecycle events
Commerce Layer commercelayer-webhooks Verify Commerce Layer webhook signatures (X-CommerceLayer-Signature, HMAC-SHA256 base64), handle orders.place, orders.pay, and shipments.ship events
Courier courier-webhooks Verify Courier outbound webhook signatures (courier-signature, HMAC-SHA256 with timestamp), handle message:updated, notification:submitted, and audiences events
Cursor cursor-webhooks Verify Cursor Cloud Agent webhook signatures, handle agent status events
Customer.io customerio-webhooks Verify Customer.io reporting webhook signatures (X-CIO-Signature, v0 HMAC-SHA256 with timestamp), handle object_type + metric events
Deepgram deepgram-webhooks Receive and verify Deepgram transcription callbacks
Discord discord-webhooks Verify Discord webhook event signatures (Ed25519), handle application and entitlement events
eBay ebay-webhooks Complete the eBay endpoint challenge, verify the x-ebay-signature (ECDSA via getPublicKey), handle MARKETPLACE_ACCOUNT_DELETION notifications
DocuSign docusign-webhooks Verify DocuSign Connect signatures (X-DocuSign-Signature-N, HMAC-SHA256 base64), handle envelope and recipient events
ElevenLabs elevenlabs-webhooks Verify ElevenLabs webhook signatures, handle call transcription events
Enode enode-webhooks Verify Enode webhook signatures (x-enode-signature, HMAC-SHA1 hex over the raw body), handle EV and energy events like user:vehicle:updated, user:charger:updated, and user:battery:updated
Exact Online exact-online-webhooks Verify Exact Online HashCode body signatures (HMAC-SHA256 over the Content node, hex, uppercased), subscribe to topics, handle Accounts, Items, StockPositions, GoodsDeliveries events
Front frontapp-webhooks Verify Front application webhook signatures (X-Front-Signature, HMAC-SHA256 over timestamp + body), complete the X-Front-Challenge handshake, handle inbound, outbound, move, assign, and tag events
Fireblocks fireblocks-webhooks Verify Fireblocks webhook v2 signatures (detached JWS RS512 via JWKS), handle transaction lifecycle events
Facebook facebook-webhooks Verify Facebook Graph API webhook signatures (X-Hub-Signature-256, HMAC-SHA256), complete the hub.challenge handshake, handle Page and User field updates
Flexport flexport-webhooks Verify Flexport webhook signatures (X-Hub-Signature-256, HMAC-SHA256), handle freight milestone events like /shipment#created and /shipment_leg#departed
Fireflies fireflies-webhooks Verify Fireflies.ai Webhooks V2 signatures (X-Hub-Signature, sha256= + HMAC-SHA256 hex over the raw body), handle meeting.transcribed / meeting.summarized / meeting.bot_joined; legacy V1 documented
FastSpring fastspring-webhooks Verify FastSpring webhook signatures (X-FS-Signature, HMAC-SHA256 base64 over the raw body), iterate the batched events array, handle order.completed, subscription.activated, subscription.charge.completed, and subscription.canceled events
FusionAuth fusionauth-webhooks Verify FusionAuth JWT webhook signatures, handle user, login, and registration events
GitHub github-webhooks Verify GitHub webhook signatures, handle push, pull_request, and issue events
GitLab gitlab-webhooks Verify GitLab webhook tokens, handle push, merge_request, issue, and pipeline events
GoCardless gocardless-webhooks Verify GoCardless webhook signatures (Webhook-Signature, HMAC-SHA256), handle batched payment, mandate, and payout events
Google Gemini gemini-webhooks Verify Gemini API webhook signatures (Standard Webhooks HMAC + JWKS modes), handle batch and long-running operation events
HubSpot hubspot-webhooks Verify HubSpot v3 webhook signatures (HMAC-SHA256 with timestamp), handle contact, deal, and company events
Hugging Face huggingface-webhooks Authenticate Hugging Face webhooks (X-Webhook-Secret), handle repo, discussion, and comment events
Intercom intercom-webhooks Verify Intercom X-Hub-Signature (HMAC-SHA1), handle conversation, contact, and ticket events
Jira jira-webhooks Verify Jira webhook signatures (X-Hub-Signature, HMAC-SHA256), handle issue and comment events
Klaviyo klaviyo-webhooks Verify Klaviyo webhook signatures (HMAC-SHA256), handle flow-triggered webhook events
Knock knock-webhooks Verify Knock outbound webhook signatures (HMAC-SHA256 base64, millisecond timestamps), handle message lifecycle and resource change events
Linear linear-webhooks Verify Linear webhook signatures (HMAC-SHA256), handle issue, comment, and project events
Lithic lithic-webhooks Verify Lithic webhooks (Standard Webhooks / Svix, webhook-signature HMAC-SHA256) with the official SDK, handle card, transaction, payment, and dispute events
LinkedIn linkedin-webhooks Verify LinkedIn webhook signatures (X-LI-Signature, HMAC-SHA256) and the challengeCode validation, handle Lead Sync and organization events
Mailchimp mailchimp-webhooks Authenticate Mailchimp webhooks (URL secret + GET validation), handle subscribe, unsubscribe, and profile events
Mailgun mailgun-webhooks Verify Mailgun webhook signatures (HMAC-SHA256), handle email delivered, failed, opened, clicked, unsubscribed, and complained events
Cisco Meraki meraki-webhooks Verify Meraki Dashboard webhook alerts via the body sharedSecret (no HMAC header), handle motion_alert, settings_changed, sensor_alert, and stopped_reporting events
Microsoft Graph microsoft-graph-webhooks Validate Microsoft Graph change notifications (validationToken handshake, clientState, rich-notification JWTs), manage subscription lifecycle
Microsoft SharePoint microsoft-sharepoint-webhooks Answer the SharePoint validationtoken handshake, validate clientState (no HMAC), handle thin list notifications and resolve changes via GetChanges (ItemAdded, ItemUpdated, ItemDeleted)
Mollie mollie-webhooks Handle unsigned Mollie webhooks by fetching payment status from the API (fetch-to-confirm pattern)
Neon neon-webhooks Verify Neon Auth webhook signatures (EdDSA / Ed25519 detached JWS via JWKS, X-Neon-Signature), handle user.created, user.before_create, send.otp, send.magic_link, and phone_number.verified events
monday.com monday-webhooks Verify monday.com webhook JWTs and the challenge handshake, handle item, column value, and update events
Notion notion-webhooks Verify Notion webhook signatures (HMAC-SHA256, X-Notion-Signature), complete handshake, handle page and comment events
Nuvemshop nuvemshop-webhooks Verify Nuvemshop (Tiendanube) webhook signatures (HMAC-SHA256 hex over raw body, x-linkedstore-hmac-sha256), handle order/created, order/paid, product/updated, and app/uninstalled events
Nylas nylas-webhooks Verify Nylas v3 webhook signatures (x-nylas-signature, HMAC-SHA256), answer the challenge handshake, handle CloudEvents-format grant, message, and calendar events
Okta okta-webhooks Complete the Okta Event Hook verification challenge, authenticate deliveries, handle user lifecycle and session events
OpenAI openai-webhooks Verify OpenAI webhooks for fine-tuning, batch, and realtime async events
OpenClaw openclaw-webhooks Verify OpenClaw Gateway webhook tokens, handle agent hook and wake event payloads
Orb orb-webhooks Verify Orb webhook signatures (HMAC-SHA256 over v1:{X-Orb-Timestamp}:{body}), handle customer, subscription, and invoice events
Oura oura-webhooks Complete the Oura subscription handshake, verify x-oura-signature (HMAC-SHA256 over timestamp + body, UPPERCASE), handle sleep, daily_readiness, daily_activity, and workout events
Paddle paddle-webhooks Verify Paddle webhook signatures, handle subscription and billing events
PayPal paypal-webhooks Verify PayPal webhook signatures (RSA-SHA256 with cert), handle payment, subscription, and order events
Pipedrive pipedrive-webhooks Authenticate Pipedrive webhooks (HTTP Basic Auth — no signature), handle create.deal, change.person, and delete.activity events
Persona persona-webhooks Verify Persona webhook signatures (Persona-Signature, t=/v1= HMAC-SHA256 pairs), handle inquiry and verification events
Paystack paystack-webhooks Verify Paystack webhook signatures (x-paystack-signature, HMAC-SHA512), handle charge, transfer, and subscription events
Polar polar-webhooks Verify Polar webhook signatures (Standard Webhooks), handle order, subscription, and checkout events
Picqer picqer-webhooks Verify Picqer webhook signatures (X-Picqer-Signature, HMAC-SHA256 base64), handle order, picklist, and stock events
Postmark postmark-webhooks Authenticate Postmark webhooks (Basic Auth/Token), handle email delivery, bounce, open, click, and spam events
Pylon pylon-webhooks Verify Pylon webhook signatures (Pylon-Webhook-Signature, hs256= HMAC-SHA256 over timestamp.body), handle B2B support issue events like issue.created and issue.updated
Razorpay razorpay-webhooks Verify Razorpay webhook signatures (X-Razorpay-Signature, HMAC-SHA256), handle payment and order events
Recharge recharge-webhooks Verify Recharge webhooks (X-Recharge-Hmac-Sha256, plain SHA-256 of secret + body, not HMAC), handle charge, subscription, and order events
Recurly recurly-webhooks Authenticate Recurly webhooks (Basic Auth), parse XML notifications for subscription and payment events
Replicate replicate-webhooks Verify Replicate webhook signatures, handle ML prediction lifecycle events
Resend resend-webhooks Verify Resend webhook signatures, handle email delivery and bounce events
RingCentral ringcentral-webhooks Complete the RingCentral Validation-Token handshake, check the optional Verification-Token header, handle message-store, presence, and telephony session events
Retell AI retell-webhooks Verify Retell webhook signatures (X-Retell-Signature, HMAC-SHA256), handle voice call events like call_started, call_ended, call_analyzed
Revolut revolut-webhooks Verify Revolut Merchant API webhook signatures (Revolut-Signature, HMAC-SHA256 over v1.{timestamp}.{body}), handle order events
Salesforce salesforce-webhooks Handle Salesforce Outbound Messages (SOAP/XML), validate OrganizationId, return the required Ack response
Sanity sanity-webhooks Verify Sanity GROQ-powered webhook signatures (sanity-webhook-signature, HMAC-SHA256 base64url), handle document change events
Scrapfly scrapfly-webhooks Verify Scrapfly webhook signatures (HMAC-SHA256, uppercase/lowercase hex), dispatch scrape, extraction, and screenshot jobs
SendGrid sendgrid-webhooks Verify SendGrid webhook signatures (ECDSA), handle email delivery events
ShipBob shipbob-webhooks Verify ShipBob webhook signatures (Standard Webhooks/Svix, webhook-signature), dispatch on x-webhook-topic, handle order.shipped, delivery, return, and WRO events
ShipHero shiphero-webhooks Verify ShipHero webhook signatures (x-shiphero-hmac-sha256, base64 HMAC-SHA256 of the raw body), dispatch on the payload webhook_type field, handle Order Allocated, Shipment Update, Inventory Update, and Return Update events
ShipStation shipstation-webhooks Handle ShipStation V1 thin-payload webhooks (fetch resource_url with Basic auth), cover ORDER_NOTIFY and SHIP_NOTIFY events
Shopify shopify-webhooks Verify Shopify HMAC signatures, handle order and product webhook events
SHOPLINE shopline-webhooks Verify SHOPLINE HMAC signatures (X-Shopline-Hmac-Sha256, base64 with hex fallback), handle orders/create, products/update, and collect/delete events
Slack slack-webhooks Verify Slack Events API signatures (HMAC-SHA256, X-Slack-Signature), handle message, app_mention, and reaction events
Solidgate solidgate-webhooks Verify Solidgate webhook signatures (merchant + signature headers, HMAC-SHA512 with base64-of-hex double-encode), handle card_gate.order.updated, subscription.updated.v2, and chargeback events
Smartcar smartcar-webhooks Verify Smartcar webhook signatures (SC-Signature, hex HMAC-SHA256 keyed with the Application Management Token), answer the VERIFY challenge, handle VEHICLE_STATE and VEHICLE_ERROR events
Square square-webhooks Verify Square webhook signatures (x-square-hmacsha256-signature over URL + body), handle payment and refund events
Statsig statsig-webhooks Verify Statsig Event Webhook signatures (HMAC-SHA256 over v0:ts:body, X-Statsig-Signature), handle exposure and config-change batches
Strava strava-webhooks Complete the Strava subscription validation handshake (hub.challenge/hub.verify_token), handle activity and athlete deauthorization events
Stripe stripe-webhooks Verify Stripe webhook signatures, parse payment event payloads, handle checkout.session.completed events
Tally tally-webhooks Verify Tally webhook signatures (Tally-Signature, HMAC-SHA256 base64, optional signing secret), handle FORM_RESPONSE submission events
Tebex tebex-webhooks Verify Tebex webhook signatures (X-Signature, two-step HMAC-SHA256 of the SHA-256 body hash), answer the validation.webhook handshake, handle payment, dispute, and recurring-payment events
Telnyx telnyx-webhooks Verify Telnyx Webhook API v2 signatures (Ed25519, telnyx-signature-ed25519 + telnyx-timestamp), handle message.received, message.sent, and message.finalized events
Treezor treezor-webhooks Verify Treezor BaaS webhook signatures (object_payload_signature body field, HMAC-SHA256 base64 over the canonicalized object_payload, not the raw body), handle banking events like payin.create, cardtransaction.create, and user.kycreview
Trello trello-webhooks Verify Trello webhook signatures (x-trello-webhook, HMAC-SHA1 over body + callbackURL), answer the HEAD check, handle board and card actions
TikTok Shop tiktok-shop-webhooks Verify TikTok Shop webhook signatures (Authorization header, HMAC-SHA256 over app_key + body), handle order, package, and product events
Svix svix-webhooks Verify Svix-delivered webhook signatures (svix-signature/webhook-signature, HMAC-SHA256) for any provider that sends webhooks via Svix
Twilio twilio-webhooks Verify Twilio webhook signatures (HMAC-SHA1, X-Twilio-Signature), handle SMS, voice, and status callback events
USPS usps-webhooks Verify USPS tracking webhook signatures (HMAC-SHA256 Base64 over timestamp + payload, X-HMAC), create tracking subscriptions, handle delivery events
Uber uber-webhooks Verify Uber Eats webhook signatures (HMAC-SHA256 hex, X-Uber-Signature, keyed with client secret), handle orders.notification, orders.cancel, and store events
Twitch twitch-webhooks Verify Twitch EventSub signatures (Twitch-Eventsub-Message-Signature, HMAC-SHA256), answer challenges, handle stream and channel events
Typeform typeform-webhooks Verify Typeform webhook signatures (Typeform-Signature, HMAC-SHA256 base64), handle form_response events
Twitter/X twitter-webhooks Verify Twitter/X Account Activity webhook signatures (x-twitter-webhooks-signature, HMAC-SHA256) and answer CRC challenges, handle tweet, favorite, and DM events
Vercel vercel-webhooks Verify Vercel webhook signatures (HMAC-SHA1), handle deployment and project events
Walmart walmart-webhooks Verify Walmart Marketplace performance webhook signatures (WM_SEC.SIGNATURE, HMAC-SHA256 over method + path + timestamp + body hash), handle PO_CREATED, INVENTORY_OOS, OFFER_PUBLISHED, and BUY_BOX_CHANGED events
Vercel Log Drains vercel-log-drains-webhooks Verify Vercel Log Drain deliveries (x-vercel-signature, HMAC-SHA1) and the x-vercel-verify handshake, handle batched json/ndjson log events
Webflow webflow-webhooks Verify Webflow webhook signatures (HMAC-SHA256), handle form submission, ecommerce, and CMS events
WeChat Pay wechat-webhooks Verify WeChat Pay APIv3 notification signatures (Wechatpay-Signature, SHA256withRSA over {timestamp}\n{nonce}\n{body}\n with the platform public key), decrypt the AEAD_AES_256_GCM resource, handle TRANSACTION.SUCCESS, REFUND.SUCCESS, and REFUND.CLOSED events
Wix wix-webhooks Verify Wix webhook JWTs (RS256 with your app's public key) for self-hosted apps, handle wix.ecom.v1.order_created, order_approved, order_updated, and order_canceled events
WhatsApp whatsapp-webhooks Verify WhatsApp Business Platform webhook signatures (X-Hub-Signature-256), complete the GET handshake, handle inbound messages and status updates
[W