Webhook Skills
This repository contains webhook-related skills for AI coding agents that need to receive, verify signatures, handle events, retry deliveries, or debug webhook integrations from various providers (see Provider Webhook Skills table below).
Skills provide step-by-step instructions, signature verification code, and runnable examples for Express, Next.js, and FastAPI.
Works with Claude Code, Cursor, VS Code Copilot, and other AI coding assistants that support the Agent Skills specification.
When Should an Agent Use These Skills?
Use these webhook skills when:
- You need to receive webhooks from third-party providers (Stripe, Shopify, GitHub, etc.)
- You need to verify webhook signatures to ensure authenticity
- You need to handle webhook event payloads and extract data
- You need to implement idempotency for webhook handlers
- You need to retry or replay failed webhook deliveries
- You need provider-specific webhook handling logic (e.g., Stripe checkout events, GitHub push events)
Skill Discovery
These skills are designed to be discoverable by agents using skill registries and tools like find-skills, where an agent searches for webhook-related capabilities by provider or task.
Available Webhook Skills
Provider Webhook Skills
Skills for receiving and verifying webhooks from specific providers. Each includes setup guides, webhook signature verification, and runnable examples.
| Provider | Skill | What It Does |
|---|---|---|
| Adyen | adyen-webhooks |
Verify Adyen webhook HMAC signatures (additionalData.hmacSignature), handle AUTHORISATION, CAPTURE, and REFUND notifications |
| Akeneo | akeneo-webhooks |
Verify Akeneo PIM Events API webhook signatures (x-akeneo-request-signature, HMAC-SHA256 hex over timestamp.body), handle batched product and product-model events like product.created, product.updated, product.removed, product_model.created, product_model.updated, and product_model.removed |
| Ashby | ashby-webhooks |
Verify Ashby webhook signatures (Ashby-Signature, HMAC-SHA256 hex over the raw body), handle recruiting events like applicationSubmit, candidateHire, candidateStageChange, and interviewScheduleCreate |
| Alipay | alipay-webhooks |
Verify Alipay (Antom / Alipay+) webhook signatures (Signature header, RSA256 / SHA256withRSA, base64URL over <METHOD> <URI>\n<Client-Id>.<Request-Time>.<body>), sign the acknowledgement response, handle notifyPayment, notifyCapture, notifyRefund, notifyAuthorization, and notifyDispute events |
| Alchemy | alchemy-webhooks |
Verify Alchemy Notify webhook signatures (X-Alchemy-Signature, HMAC-SHA256 hex over the raw body), handle ADDRESS_ACTIVITY, MINED_TRANSACTION, DROPPED_TRANSACTION, NFT_ACTIVITY, NFT_METADATA_UPDATE, and GRAPHQL events |
| Asana | asana-webhooks |
Complete the Asana X-Hook-Secret handshake, verify X-Hook-Signature (HMAC-SHA256), handle batched compact events and heartbeats |
| Ascend | ascend-webhooks |
Verify Ascend insurance-payment webhook signatures (X-Ascend-Signature, HMAC-SHA256 hex over <timestamp>:<raw_body>), handle invoice.paid, invoice.voided, payout.paid, and refund.paid events |
| Aircall | aircall-webhooks |
Verify Aircall webhooks by timing-safe comparison of the token field in the JSON body (no signature header, no HMAC), handle cloud phone events like call.created, call.answered, call.ended, message.received, contact.updated, and user.connected.v2 |
| Airtable | airtable-webhooks |
Verify Airtable webhook pings (X-Airtable-Content-MAC, HMAC-SHA256), fetch payloads with a cursor, manage 7-day webhook expiry |
| Airwallex | airwallex-webhooks |
Verify Airwallex webhook signatures (x-signature / x-timestamp, HMAC-SHA256 hex over timestamp + raw body), handle payment_intent, payment_attempt, refund, payment_consent, and payment_dispute events |
| AiPrise | aiprise-webhooks |
Verify AiPrise identity/KYC/KYB callback signatures (X-HMAC-SIGNATURE, HMAC-SHA256 hex keyed with your API private key), handle APPROVED, DECLINED, REVIEW, and UNKNOWN verification results |
| Attentive | attentive-webhooks |
Verify Attentive webhook signatures (x-attentive-hmac-sha256, HMAC-SHA256 hex), handle SMS and email subscriber events |
| Auth0 | auth0-webhooks |
Authenticate Auth0 Custom Log Stream deliveries (Authorization token), handle batched login and signup log events |
| AWS SNS | aws-sns-webhooks |
Verify AWS SNS message signatures (RSA with SigningCertURL), confirm subscriptions, handle Notification envelopes |
| BaseLinker | baselinker-webhooks |
Receive BaseLinker (Base.com) order callbacks, which arrive as bodyless HTTP HEAD requests with the whole payload in the query string (observed: order_id, state) — there is no signature, secret, or handshake to verify, so respond with a bare bodyless 200 and fetch detail via getOrders (X-BLToken) |
| BigCommerce | bigcommerce-webhooks |
Verify BigCommerce webhook callbacks (Standard Webhooks or custom headers), handle store/order and product events with API fetch-back |
| Bitbucket | bitbucket-webhooks |
Verify Bitbucket webhook signatures (X-Hub-Signature, HMAC-SHA256), handle repo push and pull request events |
| Bridge | bridge-xyz-webhooks |
Verify Bridge (bridge.xyz) webhook signatures (X-Webhook-Signature, RSA-SHA256 with a per-endpoint public key), handle customer, kyc_link, transfer, and virtual_account events |
| Bunny Stream | bunny-stream-webhooks |
Verify Bunny Stream webhook signatures (X-BunnyStream-Signature, HMAC-SHA256 hex over the raw body, keyed on the library Read-Only API key), handle video encoding events by numeric Status (3 Finished, 5 Failed, 9 CaptionsGenerated, 10 TitleOrDescriptionGenerated) |
| Bridge API | bridge-api-webhooks |
Verify Bridge API (bridgeapi.io, open-banking by Bridge/Bankin') webhook signatures (BridgeApi-Signature, HMAC-SHA256 hex with v1= scheme), handle item, item.account, payment.transaction, and user.deleted events |
| Calendly | calendly-webhooks |
Verify Calendly webhook signatures (Calendly-Webhook-Signature, HMAC-SHA256 with timestamp), handle invitee.created and invitee.canceled events |
| Chargebee | chargebee-webhooks |
Receive and verify Chargebee webhooks (Basic Auth), handle subscription billing events |
| Circle | circle-webhooks |
Verify Circle CPN/Mint webhook signatures (X-Circle-Signature, ECDSA_SHA_256), handle payments, paymentIntents, transfers, and payouts notifications |
| Claude Managed Agents | claude-managed-agents-webhooks |
Verify Anthropic Claude Managed Agents webhook signatures (X-Webhook-Signature), handle session lifecycle and outcome evaluation events |
| Clerk | clerk-webhooks |
Verify Clerk webhook signatures, handle user, session, and organization events |
| Clio | clio-webhooks |
Complete the Clio X-Hook-Secret handshake and verify X-Hook-Signature (HMAC-SHA256 hex), handle matter, contact, activity, and bill events |
| Cloudinary | cloudinary-webhooks |
Verify Cloudinary notifications via the x-cld-signature / x-cld-timestamp headers (hex digest of raw body + timestamp + account API Secret, sha1 default or sha256) using the official SDK, handle upload, eager, delete, rename, moderation, and resource_tags_changed events |
| CloudSignal (Cloudprinter.com) | cloudsignal-webhooks |
Authenticate CloudSignal (Cloudprinter.com) print-fulfilment webhooks via the plaintext per-endpoint Webhook API key in the JSON body's apikey field (no HMAC/signature header, timing-safe compared), handle CloudprinterOrderValidated, ItemValidated, ItemProduce, ItemProduced, ItemPacked, ItemShipped, ItemError, ItemCanceled, and CloudprinterOrderCanceled signals |
| Coinbase Commerce | coinbase-commerce-webhooks |
Verify Coinbase Commerce webhook signatures (X-CC-Webhook-Signature, HMAC-SHA256), handle charge lifecycle events |
| Commerce Layer | commercelayer-webhooks |
Verify Commerce Layer webhook signatures (X-CommerceLayer-Signature, HMAC-SHA256 base64), handle orders.place, orders.pay, and shipments.ship events |
| Courier | courier-webhooks |
Verify Courier outbound webhook signatures (courier-signature, HMAC-SHA256 with timestamp), handle message:updated, notification:submitted, and audiences events |
| Cursor | cursor-webhooks |
Verify Cursor Cloud Agent webhook signatures, handle agent status events |
| Customer.io | customerio-webhooks |
Verify Customer.io reporting webhook signatures (X-CIO-Signature, v0 HMAC-SHA256 with timestamp), handle object_type + metric events |
| Deepgram | deepgram-webhooks |
Receive and verify Deepgram transcription callbacks |
| Discord | discord-webhooks |
Verify Discord webhook event signatures (Ed25519), handle application and entitlement events |
| eBay | ebay-webhooks |
Complete the eBay endpoint challenge, verify the x-ebay-signature (ECDSA via getPublicKey), handle MARKETPLACE_ACCOUNT_DELETION notifications |
| DocuSign | docusign-webhooks |
Verify DocuSign Connect signatures (X-DocuSign-Signature-N, HMAC-SHA256 base64), handle envelope and recipient events |
| ElevenLabs | elevenlabs-webhooks |
Verify ElevenLabs webhook signatures, handle call transcription events |
| Enode | enode-webhooks |
Verify Enode webhook signatures (x-enode-signature, HMAC-SHA1 hex over the raw body), handle EV and energy events like user:vehicle:updated, user:charger:updated, and user:battery:updated |
| Ethoca | ethoca-webhooks |
Receive Ethoca (Mastercard) Alerts Push API webhooks — no HMAC signature; authenticity is mutual TLS (MSSL, Entrust CA) plus HTTP Basic Auth — dispatch fraud and dispute alerts on alertType |
| Exact Online | exact-online-webhooks |
Verify Exact Online HashCode body signatures (HMAC-SHA256 over the Content node, hex, uppercased), subscribe to topics, handle Accounts, Items, StockPositions, GoodsDeliveries events |
| Favro | favro-webhooks |
Verify Favro X-Favro-Webhook signatures (base64 HMAC-SHA1 over payloadId + the registered URL, NOT the body), accept the setup ping, handle card.created, card.committed, card.moved, card.updated, card.deleted, and comment.* events |
| Front | frontapp-webhooks |
Verify Front application webhook signatures (X-Front-Signature, HMAC-SHA256 over timestamp + body), complete the X-Front-Challenge handshake, handle inbound, outbound, move, assign, and tag events |
| Fireblocks | fireblocks-webhooks |
Verify Fireblocks webhook v2 signatures (detached JWS RS512 via JWKS), handle transaction lifecycle events |
facebook-webhooks |
Verify Facebook Graph API webhook signatures (X-Hub-Signature-256, HMAC-SHA256), complete the hub.challenge handshake, handle Page and User field updates |
|
| Flexport | flexport-webhooks |
Verify Flexport webhook signatures (X-Hub-Signature-256, HMAC-SHA256), handle freight milestone events like /shipment#created and /shipment_leg#departed |
| Fireflies | fireflies-webhooks |
Verify Fireflies.ai Webhooks V2 signatures (X-Hub-Signature, sha256= + HMAC-SHA256 hex over the raw body), handle meeting.transcribed / meeting.summarized / meeting.bot_joined; legacy V1 documented |
| FastSpring | fastspring-webhooks |
Verify FastSpring webhook signatures (X-FS-Signature, HMAC-SHA256 base64 over the raw body), iterate the batched events array, handle order.completed, subscription.activated, subscription.charge.completed, and subscription.canceled events |
| Faundit | faundit-webhooks |
Verify Faundit lost-and-found / returns webhook signatures (X-Faundit-Signature-Next, HMAC-SHA256 hex over v1:<timestamp>:<body> with the X-Faundit-Timestamp header; deprecated v0 X-Faundit-Signature signs v0:<timestamp> only), handle the item-status and request-status events whose granular status (delivered, finished, expired, registered, resolved, …) is the data.status field |
| FusionAuth | fusionauth-webhooks |
Verify FusionAuth JWT webhook signatures, handle user, login, and registration events |
| GitHub | github-webhooks |
Verify GitHub webhook signatures, handle push, pull_request, and issue events |
| GitLab | gitlab-webhooks |
Verify GitLab webhook tokens, handle push, merge_request, issue, and pipeline events |
| GoCardless | gocardless-webhooks |
Verify GoCardless webhook signatures (Webhook-Signature, HMAC-SHA256), handle batched payment, mandate, and payout events |
| Google Gemini | gemini-webhooks |
Verify Gemini API webhook signatures (Standard Webhooks HMAC + JWKS modes), handle batch and long-running operation events |
| Google Cloud Pub/Sub | google-pubsub-webhooks |
Verify Google Cloud Pub/Sub push subscriptions — there is no signing secret or HMAC header; validate the Google-signed OIDC Authorization: Bearer JWT (iss, aud, email, email_verified), parse the message.data / attributes envelope, and ack within the deadline |
| Green Dot | greendot-webhooks |
Authenticate Green Dot Embedded Finance (BaaS) webhook deliveries via the OAuth client_credentials Bearer token (scope post:webhook), verify the optional x-gd-signature header, echo x-GD-RequestId and return the responseDetails acknowledgement, handle transaction, accountUpdated, achTransfer, cardUpdate, billPayTransfer, directDepositSwitch, and provisioning events |
| HubSpot | hubspot-webhooks |
Verify HubSpot v3 webhook signatures (HMAC-SHA256 with timestamp), handle contact, deal, and company events |
| Hugging Face | huggingface-webhooks |
Authenticate Hugging Face webhooks (X-Webhook-Secret), handle repo, discussion, and comment events |
| Intercom | intercom-webhooks |
Verify Intercom X-Hub-Signature (HMAC-SHA1), handle conversation, contact, and ticket events |
| Jira | jira-webhooks |
Verify Jira webhook signatures (X-Hub-Signature, HMAC-SHA256), handle issue and comment events |
| Klaviyo | klaviyo-webhooks |
Verify Klaviyo webhook signatures (HMAC-SHA256), handle flow-triggered webhook events |
| Knock | knock-webhooks |
Verify Knock outbound webhook signatures (HMAC-SHA256 base64, millisecond timestamps), handle message lifecycle and resource change events |
| Linear | linear-webhooks |
Verify Linear webhook signatures (HMAC-SHA256), handle issue, comment, and project events |
| Lithic | lithic-webhooks |
Verify Lithic webhooks (Standard Webhooks / Svix, webhook-signature HMAC-SHA256) with the official SDK, handle card, transaction, payment, and dispute events |
linkedin-webhooks |
Verify LinkedIn webhook signatures (X-LI-Signature, HMAC-SHA256) and the challengeCode validation, handle Lead Sync and organization events |
|
| Mailchimp | mailchimp-webhooks |
Authenticate Mailchimp webhooks (URL secret + GET validation), handle subscribe, unsubscribe, and profile events |
| Mailgun | mailgun-webhooks |
Verify Mailgun webhook signatures (HMAC-SHA256), handle email delivered, failed, opened, clicked, unsubscribed, and complained events |
| Cisco Meraki | meraki-webhooks |
Verify Meraki Dashboard webhook alerts via the body sharedSecret (no HMAC header), handle motion_alert, settings_changed, sensor_alert, and stopped_reporting events |
| Microsoft Graph | microsoft-graph-webhooks |
Validate Microsoft Graph change notifications (validationToken handshake, clientState, rich-notification JWTs), manage subscription lifecycle |
| Microsoft SharePoint | microsoft-sharepoint-webhooks |
Answer the SharePoint validationtoken handshake, validate clientState (no HMAC), handle thin list notifications and resolve changes via GetChanges (ItemAdded, ItemUpdated, ItemDeleted) |
| Mollie | mollie-webhooks |
Handle unsigned Mollie webhooks by fetching payment status from the API (fetch-to-confirm pattern) |
| Neon | neon-webhooks |
Verify Neon Auth webhook signatures (EdDSA / Ed25519 detached JWS via JWKS, X-Neon-Signature), handle user.created, user.before_create, send.otp, send.magic_link, and phone_number.verified events |
| NMI | nmi-webhooks |
Verify NMI (Network Merchants) Webhook-Signature (t=<nonce>,s=<sig>, HMAC-SHA256 over <nonce>.<raw_body>, hex) where t is a nonce not a timestamp, handle transaction.sale.success, transaction.auth.success, transaction.refund.success, and transaction.void.success events |
| monday.com | monday-webhooks |
Verify monday.com webhook JWTs and the challenge handshake, handle item, column value, and update events |
| Notion | notion-webhooks |
Verify Notion webhook signatures (HMAC-SHA256, X-Notion-Signature), complete handshake, handle page and comment events |
| Nuvemshop | nuvemshop-webhooks |
Verify Nuvemshop (Tiendanube) webhook signatures (HMAC-SHA256 hex over raw body, x-linkedstore-hmac-sha256), handle order/created, order/paid, product/updated, and app/uninstalled events |
| Nylas | nylas-webhooks |
Verify Nylas v3 webhook signatures (x-nylas-signature, HMAC-SHA256), answer the challenge handshake, handle CloudEvents-format grant, message, and calendar events |
| Okta | okta-webhooks |
Complete the Okta Event Hook verification challenge, authenticate deliveries, handle user lifecycle and session events |
| OpenAI | openai-webhooks |
Verify OpenAI webhooks for fine-tuning, batch, and realtime async events |
| OpenClaw | openclaw-webhooks |
Verify OpenClaw Gateway webhook tokens, handle agent hook and wake event payloads |
| Orb | orb-webhooks |
Verify Orb webhook signatures (HMAC-SHA256 over v1:{X-Orb-Timestamp}:{body}), handle customer, subscription, and invoice events |
| Oura | oura-webhooks |
Complete the Oura subscription handshake, verify x-oura-signature (HMAC-SHA256 over timestamp + body, UPPERCASE), handle sleep, daily_readiness, daily_activity, and workout events |
| Paddle | paddle-webhooks |
Verify Paddle webhook signatures, handle subscription and billing events |
| PayPal | paypal-webhooks |
Verify PayPal webhook signatures (RSA-SHA256 with cert), handle payment, subscription, and order events |
| PayPro Global | paypro-global-webhooks |
Verify PayPro Global IPN webhooks (form-encoded): SIGNATURE (SHA256 over ORDER_ID+ORDER_STATUS+ORDER_TOTAL_AMOUNT+CUSTOMER_EMAIL+VALIDATION_KEY+TEST_MODE+IPN_TYPE_NAME) and HASH (MD5 of ORDER_ID+SecretKey), handle OrderCharged, OrderRefunded, and SubscriptionChargeSucceed events |
| Paymob | paymob-webhooks |
Verify Paymob transaction callbacks (HMAC-SHA512 hex over 20 ordered fields, delivered as the ?hmac= query param — not a header, not the raw body), read transaction state from success/is_refunded/is_voided/is_capture booleans |
| Pipedrive | pipedrive-webhooks |
Authenticate Pipedrive webhooks (HTTP Basic Auth — no signature), handle create.deal, change.person, and delete.activity events |
| Persona | persona-webhooks |
Verify Persona webhook signatures (Persona-Signature, t=/v1= HMAC-SHA256 pairs), handle inquiry and verification events |
| Paystack | paystack-webhooks |
Verify Paystack webhook signatures (x-paystack-signature, HMAC-SHA512), handle charge, transfer, and subscription events |
| Polar | polar-webhooks |
Verify Polar webhook signatures (Standard Webhooks), handle order, subscription, and checkout events |
| Picqer | picqer-webhooks |
Verify Picqer webhook signatures (X-Picqer-Signature, HMAC-SHA256 base64), handle order, picklist, and stock events |
| Postmark | postmark-webhooks |
Authenticate Postmark webhooks (Basic Auth/Token), handle email delivery, bounce, open, click, and spam events |
| Praxis | praxis-webhooks |
Verify Praxis (Cashier) webhook signatures (gt-authentication, SHA-384 hex over ordered field values + Merchant Secret — not HMAC, not Standard Webhooks), sign the acknowledgement (external-request-signature), handle Payment Notification transaction_status (pending, approved, rejected, error) and Subscription Notification events |
| Pylon | pylon-webhooks |
Verify Pylon webhook signatures (Pylon-Webhook-Signature, hs256= HMAC-SHA256 over timestamp.body), handle B2B support issue events like issue.created and issue.updated |
| Quoter | quoter-webhooks |
Verify Quoter webhooks (weak MD5 hash form field over HASH_KEY + timestamp + data, NOT HMAC and NOT Standard Webhooks — the hash key is optional), parse the x-www-form-urlencoded hash/timestamp/data payload, dispatch Quote, Person, and Payment create/update deliveries by ?object= |
| Razorpay | razorpay-webhooks |
Verify Razorpay webhook signatures (X-Razorpay-Signature, HMAC-SHA256), handle payment and order events |
| Recharge | recharge-webhooks |
Verify Recharge webhooks (X-Recharge-Hmac-Sha256, plain SHA-256 of secret + body, not HMAC), handle charge, subscription, and order events |
| Recurly | recurly-webhooks |
Authenticate Recurly webhooks (Basic Auth), parse XML notifications for subscription and payment events |
| Replicate | replicate-webhooks |
Verify Replicate webhook signatures, handle ML prediction lifecycle events |
| Resend | resend-webhooks |
Verify Resend webhook signatures, handle email delivery and bounce events |
| RingCentral | ringcentral-webhooks |
Complete the RingCentral Validation-Token handshake, check the optional Verification-Token header, handle message-store, presence, and telephony session events |
| Retell AI | retell-webhooks |
Verify Retell webhook signatures (X-Retell-Signature, HMAC-SHA256), handle voice call events like call_started, call_ended, call_analyzed |
| Revolut | revolut-webhooks |
Verify Revolut Merchant API webhook signatures (Revolut-Signature, HMAC-SHA256 over v1.{timestamp}.{body}), handle order events |
| Salesforce | salesforce-webhooks |
Handle Salesforce Outbound Messages (SOAP/XML), validate OrganizationId, return the required Ack response |
| Sanity | sanity-webhooks |
Verify Sanity GROQ-powered webhook signatures (sanity-webhook-signature, HMAC-SHA256 base64url), handle document change events |
| Scrapfly | scrapfly-webhooks |
Verify Scrapfly webhook signatures (HMAC-SHA256, uppercase/lowercase hex), dispatch scrape, extraction, and screenshot jobs |
| SendGrid | sendgrid-webhooks |
Verify SendGrid webhook signatures (ECDSA), handle email delivery events |
| ShipBob | shipbob-webhooks |
Verify ShipBob webhook signatures (Standard Webhooks/Svix, webhook-signature), dispatch on x-webhook-topic, handle order.shipped, delivery, return, and WRO events |
| ShipHero | shiphero-webhooks |
Verify ShipHero webhook signatures (x-shiphero-hmac-sha256, base64 HMAC-SHA256 of the raw body), dispatch on the payload webhook_type field, handle Order Allocated, Shipment Update, Inventory Update, and Return Update events |
| ShipStation | shipstation-webhooks |
Handle ShipStation V1 thin-payload webhooks (fetch resource_url with Basic auth), cover ORDER_NOTIFY and SHIP_NOTIFY events |
| Shopify | shopify-webhooks |
Verify Shopify HMAC signatures, handle order and product webhook events |
| SHOPLINE | shopline-webhooks |
Verify SHOPLINE HMAC signatures (X-Shopline-Hmac-Sha256, base64 with hex fallback), handle orders/create, products/update, and collect/delete events |
| Slack | slack-webhooks |
Verify Slack Events API signatures (HMAC-SHA256, X-Slack-Signature), handle message, app_mention, and reaction events |
| Solidgate | solidgate-webhooks |
Verify Solidgate webhook signatures (merchant + signature headers, HMAC-SHA512 with |
No comments yet
Be the first to share your take.