Sandbox
Sign in
@hookdeck/webhook-skills
Collections#Claude Code#Cursor#Copilot#Any agent#Coding#Security#Testing

Webhook skills for Claude Code, Cursor, and Copilot

This repo packages webhook guidance as Agent Skills, so builders can ask their agent to receive, verify, and handle provider webhooks with the right steps and code. Each provider skill includes setup guidance, signature verification, and runnable examples for common app frameworks.

84 stars•14 forks•JavaScript•Updated 14d ago
Who it's for

Builders who use Claude Code, Cursor, Copilot, or another skill-aware agent and need webhook setup help.

What it delivers

You can implement webhook receivers with the right signature checks and event handling instead of piecing together provider docs by hand.

What it does

Provider-specific webhook skills

One skill folder per service, including Stripe, Shopify, GitHub, and many others.

Signature verification guidance

Step-by-step instructions and code for checking webhook authenticity with the provider’s expected header or scheme.

Runnable examples

Examples for Express, Next.js, and FastAPI so you can adapt the pattern to your app.

Webhook workflow help

Covers receiving events, idempotency, retries, replay handling, and debugging webhook failures.

Skill discovery support

Designed to be found by skill registries and tools such as `find-skills`.

Agent Skills packaging

Built around the Agent Skills specification for Claude Code, Cursor, Copilot, and similar assistants.

How to get it

  1. 1Run
    # List available webhook skills
npx skills add hookdeck/webhook-skills --list

# Install Stripe webhook skill
npx skills add hookdeck/webhook-skills --skill stripe-webhooks

# Install multiple webhook skills
npx skills add hookdeck/webhook-skills --skill stripe-webhooks --skill shopify-webhooks
  2. 2Claude Code distributes this repo as a plugin marketplace. Add the marketplace once,…
    # Add this marketplace
/plugin marketplace add hookdeck/webhook-skills

# Install one provider skill (each is ~200 KB)
/plugin install stripe-webhooks@webhook-skills

# Or install all 40 webhook skills as one bundle (~3 MB)
/plugin install webhook-skills@webhook-skills
  3. 3To receive webhooks on localhost during development, run Hookdeck CLI via npx — no…
    # Start local webhook tunnel (no account required)
npx hookdeck-cli listen 3000 stripe --path /webhooks/stripe

README

Webhook Skills

This repository contains webhook-related skills for AI coding agents that need to receive, verify signatures, handle events, retry deliveries, or debug webhook integrations from various providers (see Provider Webhook Skills table below).

Skills provide step-by-step instructions, signature verification code, and runnable examples for Express, Next.js, and FastAPI.

Works with Claude Code, Cursor, VS Code Copilot, and other AI coding assistants that support the Agent Skills specification.

When Should an Agent Use These Skills?

Use these webhook skills when:

  • You need to receive webhooks from third-party providers (Stripe, Shopify, GitHub, etc.)
  • You need to verify webhook signatures to ensure authenticity
  • You need to handle webhook event payloads and extract data
  • You need to implement idempotency for webhook handlers
  • You need to retry or replay failed webhook deliveries
  • You need provider-specific webhook handling logic (e.g., Stripe checkout events, GitHub push events)

Skill Discovery

These skills are designed to be discoverable by agents using skill registries and tools like find-skills, where an agent searches for webhook-related capabilities by provider or task.

Available Webhook Skills

Provider Webhook Skills

Skills for receiving and verifying webhooks from specific providers. Each includes setup guides, webhook signature verification, and runnable examples.

ProviderSkillWhat It Does
Adyenadyen-webhooksVerify Adyen webhook HMAC signatures (additionalData.hmacSignature), handle AUTHORISATION, CAPTURE, and REFUND notifications
Akeneoakeneo-webhooksVerify Akeneo PIM Events API webhook signatures (x-akeneo-request-signature, HMAC-SHA256 hex over timestamp.body), handle batched product and product-model events like product.created, product.updated, product.removed, product_model.created, product_model.updated, and product_model.removed
Ashbyashby-webhooksVerify Ashby webhook signatures (Ashby-Signature, HMAC-SHA256 hex over the raw body), handle recruiting events like applicationSubmit, candidateHire, candidateStageChange, and interviewScheduleCreate
Alipayalipay-webhooksVerify Alipay (Antom / Alipay+) webhook signatures (Signature header, RSA256 / SHA256withRSA, base64URL over <METHOD> <URI>\n<Client-Id>.<Request-Time>.<body>), sign the acknowledgement response, handle notifyPayment, notifyCapture, notifyRefund, notifyAuthorization, and notifyDispute events
Alchemyalchemy-webhooksVerify Alchemy Notify webhook signatures (X-Alchemy-Signature, HMAC-SHA256 hex over the raw body), handle ADDRESS_ACTIVITY, NFT_ACTIVITY, and GRAPHQL events
Asanaasana-webhooksComplete the Asana X-Hook-Secret handshake, verify X-Hook-Signature (HMAC-SHA256), handle batched compact events and heartbeats
Ascendascend-webhooksVerify Ascend insurance-payment webhook signatures (X-Ascend-Signature, HMAC-SHA256 hex over <timestamp>:<raw_body>), handle invoice.paid, invoice.voided, payout.paid, and refund.paid events
Aircallaircall-webhooksVerify Aircall webhooks by timing-safe comparison of the token field in the JSON body (no signature header, no HMAC), handle cloud phone events like call.created, call.answered, call.ended, message.received, contact.updated, and user.connected.v2
Airtableairtable-webhooksVerify Airtable webhook pings (X-Airtable-Content-MAC, HMAC-SHA256), fetch payloads with a cursor, manage 7-day webhook expiry
Airwallexairwallex-webhooksVerify Airwallex webhook signatures (x-signature / x-timestamp, HMAC-SHA256 hex over timestamp + raw body), handle payment_intent, payment_attempt, refund, payment_consent, and payment_dispute events
AiPriseaiprise-webhooksVerify AiPrise identity/KYC/KYB callback signatures (X-HMAC-SIGNATURE, HMAC-SHA256 hex keyed with your API private key), handle APPROVED, DECLINED, REVIEW, and UNKNOWN verification results
Attentiveattentive-webhooksVerify Attentive webhook signatures (x-attentive-hmac-sha256, HMAC-SHA256 hex), handle SMS and email subscriber events
Auth0auth0-webhooksAuthenticate Auth0 Custom Log Stream deliveries (Authorization token), handle batched login and signup log events
AWS SNSaws-sns-webhooksVerify AWS SNS message signatures (RSA with SigningCertURL), confirm subscriptions, handle Notification envelopes
Azure Event Gridazure-event-grid-webhooksReceive Azure Event Grid deliveries, which carry no payload signature at all — trust comes from the ownership handshake (Microsoft.EventGrid.SubscriptionValidationEvent echoed as validationResponse with HTTP 200, or the CloudEvents v1.0 OPTIONS abuse-protection preflight) plus channel auth via a static delivery-property header, a query-parameter client secret, or a Microsoft Entra ID bearer token; guard on aeg-subscription-name and parse Event Grid arrays vs CloudEvents objects
BaseLinkerbaselinker-webhooksReceive BaseLinker (Base.com) order callbacks, which arrive as bodyless HTTP HEAD requests with the whole payload in the query string (observed: order_id, state) — there is no signature, secret, or handshake to verify, so respond with a bare bodyless 200 and fetch detail via getOrders (X-BLToken)
BigCommercebigcommerce-webhooksVerify BigCommerce webhook callbacks (Standard Webhooks or custom headers), handle store/order and product events with API fetch-back
Bitbucketbitbucket-webhooksVerify Bitbucket webhook signatures (X-Hub-Signature, HMAC-SHA256), handle repo push and pull request events
Bridgebridge-xyz-webhooksVerify Bridge (bridge.xyz) webhook signatures (X-Webhook-Signature, RSA-SHA256 with a per-endpoint public key), handle customer, kyc_link, transfer, and virtual_account events
Bunny Streambunny-stream-webhooksVerify Bunny Stream webhook signatures (X-BunnyStream-Signature, HMAC-SHA256 hex over the raw body, keyed on the library Read-Only API key), handle video encoding events by numeric Status (3 Finished, 5 Failed, 9 CaptionsGenerated, 10 TitleOrDescriptionGenerated)
Bridge APIbridge-api-webhooksVerify Bridge API (bridgeapi.io, open-banking by Bridge/Bankin') webhook signatures (BridgeApi-Signature, HMAC-SHA256 hex with v1= scheme), handle item, item.account, payment.transaction, and user.deleted events
Calendlycalendly-webhooksVerify Calendly webhook signatures (Calendly-Webhook-Signature, HMAC-SHA256 with timestamp), handle invitee.created and invitee.canceled events
Chargebeechargebee-webhooksReceive and verify Chargebee webhooks (Basic Auth), handle subscription billing events
Circlecircle-webhooksVerify Circle CPN/Mint webhook signatures (X-Circle-Signature, ECDSA_SHA_256), handle payments, paymentIntents, transfers, and payouts notifications
Claude Managed Agentsclaude-managed-agents-webhooksVerify Anthropic Claude Managed Agents webhook signatures (X-Webhook-Signature), handle session lifecycle and outcome evaluation events
Clerkclerk-webhooksVerify Clerk webhook signatures, handle user, session, and organization events
Clioclio-webhooksComplete the Clio X-Hook-Secret handshake and verify X-Hook-Signature (HMAC-SHA256 hex), handle matter, contact, activity, and bill events
Cloudinarycloudinary-webhooksVerify Cloudinary notifications via the x-cld-signature / x-cld-timestamp headers (hex digest of raw body + timestamp + account API Secret, sha1 default or sha256) using the official SDK, handle upload, eager, delete, rename, moderation, and resource_tags_changed events
CloudSignal (Cloudprinter.com)cloudsignal-webhooksAuthenticate CloudSignal (Cloudprinter.com) print-fulfilment webhooks via the plaintext per-endpoint Webhook API key in the JSON body's apikey field (no HMAC/signature header, timing-safe compared), handle CloudprinterOrderValidated, ItemValidated, ItemProduce, ItemProduced, ItemPacked, ItemShipped, ItemError, ItemCanceled, and CloudprinterOrderCanceled signals
Coinbase Commercecoinbase-commerce-webhooksVerify Coinbase Commerce webhook signatures (X-CC-Webhook-Signature, HMAC-SHA256), handle charge lifecycle events
Commerce Layercommercelayer-webhooksVerify Commerce Layer webhook signatures (X-CommerceLayer-Signature, HMAC-SHA256 base64), handle orders.place, orders.pay, and shipments.ship events
Communitycommunity-webhooksVerify Community (community.com SMS platform) webhook signatures (community-signature, HMAC-SHA256 hex over {t}.{raw_body}), handle message.inbound, message.outbound, member.created, member.updated, and member.deleted events
Couriercourier-webhooksVerify Courier outbound webhook signatures (courier-signature, HMAC-SHA256 with timestamp), handle message:updated, notification:submitted, and audiences events
Cronofycronofy-webhooksVerify Cronofy push notifications (Cronofy-HMAC-SHA256, a comma-separated list of base64 HMAC-SHA256 digests over the raw body keyed with the app client secret, any match wins), handle verification, change, profile_disconnected, conferencing_profile_disconnected, profile_initial_sync_completed, and gdpr_requested notifications
Cursorcursor-webhooksVerify Cursor Cloud Agent webhook signatures, handle agent status events
Customer.iocustomerio-webhooksVerify Customer.io reporting webhook signatures (X-CIO-Signature, v0 HMAC-SHA256 with timestamp), handle object_type + metric events
Deepgramdeepgram-webhooksReceive and verify Deepgram transcription callbacks
Discorddiscord-webhooksVerify Discord webhook event signatures (Ed25519), handle application and entitlement events
eBayebay-webhooksComplete the eBay endpoint challenge, verify the x-ebay-signature (ECDSA via getPublicKey), handle MARKETPLACE_ACCOUNT_DELETION notifications
DocuSigndocusign-webhooksVerify DocuSign Connect signatures (X-DocuSign-Signature-N, HMAC-SHA256 base64), handle envelope and recipient events
ElevenLabselevenlabs-webhooksVerify ElevenLabs webhook signatures, handle call transcription events
Enodeenode-webhooksVerify Enode webhook signatures (x-enode-signature, HMAC-SHA1 hex over the raw body), handle EV and energy events like user:vehicle:updated, user:charger:updated, and user:battery:updated
Ethocaethoca-webhooksReceive Ethoca (Mastercard) Alerts Push API webhooks — no HMAC signature; authenticity is mutual TLS (MSSL, Entrust CA) plus HTTP Basic Auth — dispatch fraud and dispute alerts on alertType
Exact Onlineexact-online-webhooksVerify Exact Online HashCode body signatures (HMAC-SHA256 over the Content node, hex, uppercased), subscribe to topics, handle Accounts, Items, StockPositions, GoodsDeliveries events
Favrofavro-webhooksVerify Favro X-Favro-Webhook signatures (base64 HMAC-SHA1 over payloadId + the registered URL, NOT the body), accept the setup ping, handle card.created, card.committed, card.moved, card.updated, card.deleted, and comment.* events
Frontfrontapp-webhooksVerify Front application webhook signatures (X-Front-Signature, HMAC-SHA256 over timestamp + body), complete the X-Front-Challenge handshake, handle inbound, outbound, move, assign, and tag events
Fireblocksfireblocks-webhooksVerify Fireblocks webhook v2 signatures (detached JWS RS512 via JWKS), handle transaction lifecycle events
Facebookfacebook-webhooksVerify Facebook Graph API webhook signatures (X-Hub-Signature-256, HMAC-SHA256), complete the hub.challenge handshake, handle Page and User field updates
Flexportflexport-webhooksVerify Flexport webhook signatures (X-Hub-Signature-256, HMAC-SHA256), handle freight milestone events like /shipment#created and /shipment_leg#departed
Firefliesfireflies-webhooksVerify Fireflies.ai Webhooks V2 signatures (X-Hub-Signature, sha256= + HMAC-SHA256 hex over the raw body), handle meeting.transcribed / meeting.summarized / meeting.bot_joined; legacy V1 documented
FastSpringfastspring-webhooksVerify FastSpring webhook signatures (X-FS-Signature, HMAC-SHA256 base64 over the raw body), iterate the batched events array, handle order.completed, subscription.activated, subscription.charge.completed, and subscription.canceled events
Faunditfaundit-webhooksVerify Faundit lost-and-found / returns webhook signatures (X-Faundit-Signature-Next, HMAC-SHA256 hex over v1:<timestamp>:<body> with the X-Faundit-Timestamp header; deprecated v0 X-Faundit-Signature signs v0:<timestamp> only), handle the item-status and request-status events whose granular status (delivered, finished, expired, registered, resolved, …) is the data.status field
FusionAuthfusionauth-webhooksVerify FusionAuth JWT webhook signatures, handle user, login, and registration events
GitHubgithub-webhooksVerify GitHub webhook signatures, handle push, pull_request, and issue events
GitLabgitlab-webhooksVerify GitLab webhook tokens, handle push, merge_request, issue, and pipeline events
GoCardlessgocardless-webhooksVerify GoCardless webhook signatures (Webhook-Signature, HMAC-SHA256), handle batched payment, mandate, and payout events
Google Geminigemini-webhooksVerify Gemini API webhook signatures (Standard Webhooks HMAC + JWKS modes), handle batch and long-running operation events
Google Cloud Pub/Subgoogle-pubsub-webhooksVerify Google Cloud Pub/Sub push subscriptions — there is no signing secret or HMAC header; validate the Google-signed OIDC Authorization: Bearer JWT (iss, aud, email, email_verified), parse the message.data / attributes envelope, and ack within the deadline
Green Dotgreendot-webhooksAuthenticate Green Dot Embedded Finance (BaaS) webhook deliveries via the OAuth client_credentials Bearer token (scope post:webhook), verify the optional x-gd-signature header, echo x-GD-RequestId and return the responseDetails acknowledgement, handle transaction, accountUpdated, achTransfer, cardUpdate, billPayTransfer, directDepositSwitch, and provisioning events
HubSpothubspot-webhooksVerify HubSpot v3 webhook signatures (HMAC-SHA256 with timestamp), handle contact, deal, and company events
Hugging Facehuggingface-webhooksAuthenticate Hugging Face webhooks (X-Webhook-Secret), handle repo, discussion, and comment events
Intercomintercom-webhooksVerify Intercom X-Hub-Signature (HMAC-SHA1), handle conversation, contact, and ticket events
Jirajira-webhooksVerify Jira webhook signatures (X-Hub-Signature, HMAC-SHA256), handle issue and comment events
Klaviyoklaviyo-webhooksVerify Klaviyo webhook signatures (HMAC-SHA256), handle flow-triggered webhook events
Knockknock-webhooksVerify Knock outbound webhook signatures (HMAC-SHA256 base64, millisecond timestamps), handle message lifecycle and resource change events
Linearlinear-webhooksVerify Linear webhook signatures (HMAC-SHA256), handle issue, comment, and project events
Lithiclithic-webhooksVerify Lithic webhooks (Standard Webhooks / Svix, webhook-signature HMAC-SHA256) with the official SDK, handle card, transaction, payment, and dispute events
LinkedInlinkedin-webhooksVerify LinkedIn webhook signatures (X-LI-Signature, HMAC-SHA256) and the challengeCode validation, handle Lead Sync and organization events
Mailchimpmailchimp-webhooksAuthenticate Mailchimp webhooks (URL secret + GET validation), handle subscribe, unsubscribe, and profile events
MailerSendmailersend-webhooksVerify MailerSend webhooks (Signature header, HMAC-SHA256 hex over the raw body), handle the webhook.test URL-validation ping and activity.sent, activity.delivered, activity.hard_bounced, activity.opened, activity.clicked, and activity.spam_complaint events
Mailgunmailgun-webhooksVerify Mailgun webhook signatures (HMAC-SHA256), handle email delivered, failed, opened, clicked, unsubscribed, and complained events
Cisco Merakimeraki-webhooksVerify Meraki Dashboard webhook alerts via the body sharedSecret (no HMAC header), handle motion_alert, settings_changed, sensor_alert, and stopped_reporting events
Microsoft Graphmicrosoft-graph-webhooksValidate Microsoft Graph change notifications (validationToken handshake, clientState, rich-notification JWTs), manage subscription lifecycle
Microsoft SharePointmicrosoft-sharepoint-webhooksAnswer the SharePoint validationtoken handshake, validate clientState (no HMAC), handle thin list notifications and resolve changes via GetChanges (ItemAdded, ItemUpdated, ItemDeleted)
Molliemollie-webhooksHandle unsigned Mollie webhooks by fetching payment status from the API (fetch-to-confirm pattern)
Neonneon-webhooksVerify Neon Auth webhook signatures (EdDSA / Ed25519 detached JWS via JWKS, X-Neon-Signature), handle user.created, user.before_create, send.otp, send.magic_link, and phone_number.verified events
NMInmi-webhooksVerify NMI (Network Merchants) Webhook-Signature (t=<nonce>,s=<sig>, HMAC-SHA256 over <nonce>.<raw_body>, hex) where t is a nonce not a timestamp, handle transaction.sale.success, transaction.auth.success, transaction.refund.success, and transaction.void.success events
monday.commonday-webhooksVerify monday.com webhook JWTs and the challenge handshake, handle item, column value, and update events
Notionnotion-webhooksVerify Notion webhook signatures (HMAC-SHA256, X-Notion-Signature), complete handshake, handle page and comment events
Nuvemshopnuvemshop-webhooksVerify Nuvemshop (Tiendanube) webhook signatures (HMAC-SHA256 hex over raw body, x-linkedstore-hmac-sha256), handle order/created, order/paid, product/updated, and app/uninstalled events
Nylasnylas-webhooksVerify Nylas v3 webhook signatures (x-nylas-signature, HMAC-SHA256), answer the challenge handshake, handle CloudEvents-format grant, message, and calendar events
Oktaokta-webhooksComplete the Okta Event Hook verification challenge, authenticate deliveries, handle user lifecycle and session events
OpenAIopenai-webhooksVerify OpenAI webhooks for fine-tuning, batch, and realtime async events
OpenClawopenclaw-webhooksVerify OpenClaw Gateway webhook tokens, handle agent hook and wake event payloads
Orborb-webhooksVerify Orb webhook signatures (HMAC-SHA256 over v1:{X-Orb-Timestamp}:{body}), handle customer, subscription, and invoice events
Ouraoura-webhooksComplete the Oura subscription handshake, verify x-oura-signature (HMAC-SHA256 over timestamp + body, UPPERCASE), handle sleep, daily_readiness, daily_activity, and workout events
Paddlepaddle-webhooksVerify Paddle webhook signatures, handle subscription and billing events
PayPalpaypal-webhooksVerify PayPal webhook signatures (RSA-SHA256 with cert), handle payment, subscription, and order events
PayPro Globalpaypro-global-webhooksVerify PayPro Global IPN webhooks (form-encoded): SIGNATURE (SHA256 over ORDER_ID+ORDER_STATUS+ORDER_TOTAL_AMOUNT+CUSTOMER_EMAIL+VALIDATION_KEY+TEST_MODE+IPN_TYPE_NAME) and HASH (MD5 of ORDER_ID+SecretKey), handle OrderCharged, OrderRefunded, and SubscriptionChargeSucceed events
Paymobpaymob-webhooksVerify Paymob transaction callbacks (HMAC-SHA512 hex over 20 ordered fields, delivered as the ?hmac= query param — not a header, not the raw body), read transaction state from success/is_refunded/is_voided/is_capture booleans
Pipedrivepipedrive-webhooksAuthenticate Pipedrive webhooks (HTTP Basic Auth — no signature), handle create.deal, change.person, and delete.activity events
Personapersona-webhooksVerify Persona webhook signatures (Persona-Signature, t=/v1= HMAC-SHA256 pairs), handle inquiry and verification events
Paystackpaystack-webhooksVerify Paystack webhook signatures (x-paystack-signature, HMAC-SHA512), handle charge, transfer, and subscription events
Polarpolar-webhooksVerify Polar webhook signatures (Standard Webhooks), handle order, subscription, and checkout events
Picqerpicqer-webhooksVerify Picqer webhook signatures (X-Picqer-Signature, HMAC-SHA256 base64), handle order, picklist, and stock events
Postmarkpostmark-webhooksAuthenticate Postmark webhooks (Basic Auth/Token), handle email delivery, bounce, open, click, and spam events
Praxispraxis-webhooksVerify Praxis (Cashier) webhook signatures (gt-authentication, SHA-384 hex over ordered field values + Merchant Secret — not HMAC, not Standard Webhooks), sign the acknowledgement (external-request-signature), handle Payment Notification transaction_status (pending, approved, rejected, error) and Subscription Notification events
Pylonpylon-webhooksVerify Pylon webhook signatures (Pylon-Webhook-Signature, hs256= HMAC-SHA256 over timestamp.body), handle B2B support issue events like issue.created and issue.updated
Quoterquoter-webhooksVerify Quoter webhooks (weak MD5 hash form field over HASH_KEY + timestamp + data, NOT HMAC and NOT Standard Webhooks — the hash key is optional), parse the x-www-form-urlencoded hash/timestamp/data payload, dispatch Quote, Person, and Payment create/update deliveries by ?object=
Razorpayrazorpay-webhooksVerify Razorpay webhook signatures (X-Razorpay-Signature, HMAC-SHA256), handle payment and order events
Rechargerecharge-webhooksVerify Recharge webhooks (X-Recharge-Hmac-Sha256, plain SHA-256 of secret + body, not HMAC), handle charge, subscription, and order events
Recurlyrecurly-webhooksAuthenticate Recurly webhooks (Basic Auth), parse XML notifications for subscription and payment events
Replicatereplicate-webhooksVerify Replicate webhook signatures, handle ML prediction lifecycle events
Resendresend-webhooksVerify Resend webhook signatures, handle email delivery and bounce events
RingCentralringcentral-webhooksComplete the RingCentral Validation-Token handshake, check the optional Verification-Token header, handle message-store, presence, and telephony session events
Retell AIretell-webhooksVerify Retell webhook signatures (X-Retell-Signature, HMAC-SHA256), handle voice call events like call_started, call_ended, call_analyzed
Revolutrevolut-webhooksVerify Revolut Merchant API webhook signatures (Revolut-Signature, HMAC-SHA256 over v1.{timestamp}.{body}), handle order events
Salesforcesalesforce-webhooksHandle Salesforce Outbound Messages (SOAP/XML), validate OrganizationId, return the required Ack response
Sanitysanity-webhooksVerify Sanity GROQ-powered webhook signatures (sanity-webhook-signature, HMAC-SHA256 base64url), handle document change events
Scrapflyscrapfly-webhooksVerify Scrapfly webhook signatures (HMAC-SHA256, uppercase/lowercase hex), dispatch scrape, extraction, and screenshot jobs
SendGridsendgrid-webhooksVerify SendGrid webhook signatures (ECDSA), handle email delivery events
ShipBobshipbob-webhooksVerify ShipBob webhook signatures (Standard Webhooks/Svix, webhook-signature), dispatch on x-webhook-topic, handle order.shipped, delivery, return, and WRO events
ShipHeroshiphero-webhooksVerify ShipHero webhook signatures (x-shiphero-hmac-sha256, base64 HMAC-SHA256 of the raw body), dispatch on the payload webhook_type field, handle Order Allocated, Shipment Update, Inventory Update, and Return Update events
ShipStationshipstation-webhooksHandle ShipStation V1 thin-payload webhooks (fetch resource_url with Basic auth), cover ORDER_NOTIFY and SHIP_NOTIFY events
Shopifyshopify-webhooksVerify Shopify HMAC signatures, handle order and product webhook events
SHOPLINEshopline-webhooksVerify SHOPLINE HMAC signatures (X-Shopline-Hmac-Sha256, base64 with hex fallback), handle orders/create, products/update, and collect/delete events
Slackslack-webhooksVerify Slack Events API signatures (HMAC-SHA256, X-Slack-Signature), handle message, app_mention, and reaction events
Solidgatesolidgate-webhooksVerify Solidgate webhook signatures (merchant + signature headers, HMAC-SHA512 with base64-of-hex double-encode), handle card_gate.order.updated, subscription.updated.v2, and chargeback events
Smartcarsmartcar-webhooksVerify Smartcar webhook signatures (SC-Signature, hex HMAC-SHA256 keyed with the Application Management Token), answer the VERIFY challenge, handle VEHICLE_STATE and VEHICLE_ERROR events
Smile APIsmile-webhooksVerify Smile API (getsmileapi.com, SE Asia employment/income data — not Smile.io or Smile Identity) webhook signatures (Smile-Signature, HMAC-SHA512 hex over the raw body), dedupe on the event id, handle ACCOUNT_CONNECTED, TASK_FINISHED, INCOMES_ADDED, EMPLOYMENTS_ADDED, IDENTITY_ADDED, and RECORD_COMPLETED events
Squaresquare-webhooksVerify Square webhook signatures (x-square-hmacsha256-signature over URL + body), handle payment and refund events
Statsigstatsig-webhooksVerify Statsig Event Webhook signatures (HMAC-SHA256 over v0:ts:body, X-Statsig-Signature), handle exposure and config-change batches
Stravastrava-webhooksComplete the Strava subscription validation handshake (hub.challenge/hub.verify_token), handle activity and athlete deauthorization events
Stripestripe-webhooksVerify Stripe webhook signatures, parse payment event payloads, handle checkout.session.completed events
Supabasesupabase-webhooksHandle both Supabase surfaces: Database Webhooks (INSERT/UPDATE/DELETE via pg_net triggers, unsigned — authenticate with a developer-configured shared-secret header) and Auth Hooks (Standard Webhooks HMAC-SHA256 over {webhook-id}.{webhook-timestamp}.{raw_body}, v1,whsec_ secret), covering send_email, send_sms, custom_access_token, before_user_created, mfa_verification_attempt, and password_verification_attempt
Syncterasynctera-webhooksVerify Synctera BaaS webhooks (custom HMAC-SHA256 hex over {Request-Timestamp}.{raw_body}, Synctera-Signature + Request-Timestamp headers, secret from POST /v0/webhook_secrets, rolling secret support), handle ACCOUNT.UPDATED, CARD.CREATED, TRANSACTION.CREATED, and DISPUTE.CREATED events
Tallytally-webhooksVerify Tally webhook signatures (Tally-Signature, HMAC-SHA256 base64, optional signing secret), handle FORM_RESPONSE submission events
Tebextebex-webhooksVerify Tebex webhook signatures (X-Signature, two-step HMAC-SHA256 of the SHA-256 body hash), answer the validation.webhook handshake, handle payment, dispute, and recurring-payment events
Telnyxtelnyx-webhooksVerify Telnyx Webhook API v2 signatures (Ed25519, telnyx-signature-ed25519 + telnyx-timestamp), handle message.received, message.sent, and message.finalized events
Token.iotokenio-webhooksVerify Token.io open banking webhook signatures (asymmetric Ed25519, token-signature over the raw body, token-event for the type), subscribe via PUT /webhook/config, handle PAYMENT_STATUS_CHANGED, REFUND_STATUS_CHANGED, VRP_STATUS_CHANGED, and VIRTUAL_ACCOUNT_CREDIT_RECEIVED events
Treezortreezor-webhooksVerify Treezor BaaS webhook signatures (object_payload_signature body field, HMAC-SHA256 base64 over the canonicalized object_payload, not the raw body), handle banking events like payin.create, cardtransaction.create, and user.kycreview
Trellotrello-webhooksVerify Trello webhook signatures (x-trello-webhook, HMAC-SHA1 over body + callbackURL), answer the HEAD check, handle board and card actions
TikToktiktok-webhooksVerify TikTok for Developers webhook signatures (TikTok-Signature, HMAC-SHA256 hex over <timestamp>.<body>), handle authorization.removed, video.upload.failed, video.publish.completed, and portability.download.ready events
TikTok Shoptiktok-shop-webhooksVerify TikTok Shop webhook signatures (Authorization header, HMAC-SHA256 over app_key + body), handle order, package, and product events
Svixsvix-webhooksVerify Svix-delivered webhook signatures (svix-signature/webhook-signature, HMAC-SHA256) for any provider that sends webhooks via Svix
Twiliotwilio-webhooksVerify Twilio webhook signatures (HMAC-SHA1, X-Twilio-Signature), handle SMS, voice, and status callback events
USPSusps-webhooksVerify USPS tracking webhook signatures (HMAC-SHA256 Base64 over timestamp + payload, X-HMAC), create tracking subscriptions, handle delivery events
Uberuber-webhooksVerify Uber Eats webhook signatures (HMAC-SHA256 hex, X-Uber-Signature, keyed with client secret), handle orders.notification, orders.cancel, and store events
Upolloupollo-webhooksVerify Upollo fraud/risk webhook signatures (Upollo-Signature, t:/s0: HMAC-SHA512 over the raw body), react to flags like ACCOUNT_SHARING and MULTIPLE_ACCOUNTS and the recommended action (CHALLENGE/DENY/PERMIT)
Utilautila-webhooksVerify Utila webhook signatures (x-utila-signature, asymmetric RSA-4096 + SHA-512 + PSS, no shared secret), handle TRANSACTION_CREATED, TRANSACTION_STATE_UPDATED, WALLET_CREATED, WALLET_ADDRESS_CREATED, and TRANSACTION_AML_SCREENING_RESULT_READY events
Twitchtwitch-webhooksVerify Twitch EventSub signatures (Twitch-Eventsub-Message-Signature, HMAC-SHA256), answer challenges, handle stream and channel events
Typeformtypeform-webhooksVerify Typeform webhook signatures (Typeform-Signature, HMAC-SHA256 base64), handle form_response events
Twitter/Xtwitter-webhooksVerify Twitter/X Account Activity webhook signatures (x-twitter-webhooks-signature, HMAC-SHA256) and answer CRC challenges, handle tweet, favorite, and DM events
Vercelvercel-webhooksVerify Vercel webhook signatures (HMAC-SHA1), handle deployment and project events
Vapivapi-webhooksAuthenticate Vapi "Server URL" webhooks with a shared secret (Authorization: Bearer or legacy X-Vapi-Secret, timing-safe compare — Vapi has no fixed HMAC scheme; OAuth 2.0 and a configurable HMAC are also supported), dispatch on the nested message.type, and return the required JSON body for the request/response types assistant-request, tool-calls, transfer-destination-request, and knowledge-base-request
Walmartwalmart-webhooksVerify Walmart Marketplace performance webhook signatures (WM_SEC.SIGNATURE, HMAC-SHA256 over method + path + timestamp + body hash), handle PO_CREATED, INVENTORY_OOS, OFFER_PUBLISHED, and BUY_BOX_CHANGED events
Vercel Log Drainsvercel-log-drains-webhooksVerify Vercel Log Drain deliveries (x-vercel-signature, HMAC-SHA1) and the x-vercel-verify handshake, handle batched json/ndjson log events
Webflowwebflow-webhooksVerify Webflow webhook signatures (HMAC-SHA256), handle form submission, ecommerce, and CMS events
WeChat Paywechat-webhooksVerify WeChat Pay APIv3 notification signatures (Wechatpay-Signature, SHA256withRSA over {timestamp}\n{nonce}\n{body}\n with the platform public key), decrypt the AEAD_AES_256_GCM resource, handle TRANSACTION.SUCCESS, REFUND.SUCCESS, and REFUND.CLOSED events
Wixwix-webhooksVerify Wix webhook JWTs (RS256 with your app's public key) for self-hosted apps, handle wix.ecom.v1.order_created, order_approved, order_updated, and order_canceled events
WhatsAppwhatsapp-webhooksVerify WhatsApp Business Platform webhook signatures (X-Hub-Signature-256), complete the GET handshake, handle inbound messages and status updates
WooCommercewoocommerce-webhooksVerify WooCommerce webhook signatures, handle order, product, and customer events
WorkOSworkos-webhooksVerify WorkOS webhook signatures (WorkOS-Signature, HMAC-SHA256 with timestamp), handle Directory Sync and auth events
Xeroxero-webhooksVerify Xero webhook signatures (x-xero-signature, HMAC-SHA256 base64), pass Intent to Receive (ITR) with 200/401, handle CONTACT, INVOICE, CREDITNOTE, and SUBSCRIPTION events
Zendeskzendesk-webhooksVerify Zendesk webhook signatures (X-Zendesk-Webhook-Signature, HMAC-SHA256 with timestamp), handle event subscriptions and trigger-based webhooks
Zero Hashzerohash-webhooksVerify Zero Hash webhook signatures (x-zh-hook-signature, HMAC-SHA256 hex over payload + timestamp with replay protection; legacy x-zh-hook-signature-256), handle trade_status_changed and account_balance.changed events
Ziftzift-webhooksReceive Zift payment notifications — no HMAC signature; acknowledge each delivery by echoing {"notificationId": ...} — dispatch billing.* and processing.* events like billing.subscription-created, processing.chargeback, and processing.return
Zoomzoom-webhooksVerify Zoom webhook signatures (x-zm-signature), complete the URL validation handshake, handle meeting and recording events

Webhook Handler Pattern Skills

Framework-agnostic best practices for webhook handling, applicable across any webhook integration.

SkillWhat It Does
webhook-handler-patternsImplement webhook idempotency, error handling, retry logic, async processing

Webhook Infrastructure Skills

Skills for webhook infrastructure products — routing, queuing, delivery, and observability.

ProductSkillWhat It Does
Hookdeck Event Gatewayhookdeck-event-gatewayWebhook infrastructure that replaces your queue — guaranteed delivery, retries, rate limiting, replay, observability
Hookdeck Event Gateway (receiver)hookdeck-event-gateway-webhooksVerify x-hookdeck-signature and handle webhooks forwarded by the Hookdeck Event Gateway
Hookdeck OutpostoutpostSend webhooks and events to user-preferred destinations (HTTP, SQS, RabbitMQ, Pub/Sub, EventBridge, Kafka)

Webhook & Event Destinations DX Audit Skills

Meta-skills that evaluate the developer experience of platforms sending outbound webhooks and event destinations, rather than helping you receive or send them. "Event destinations" covers the broader case where a platform delivers events to user-chosen destinations beyond HTTP (SQS, Pub/Sub, RabbitMQ, EventBridge, Kafka), not only webhooks.

SkillWhat It Does
webhook-dx-auditAudit a platform's outbound webhook and event destinations DX (signing, retries, event catalog, observability, local dev, agent readiness) and produce a scored review with prioritized recommendations

Quick Start

Install with npx skills (any AI assistant)

# List available webhook skills
npx skills add hookdeck/webhook-skills --list

# Install Stripe webhook skill
npx skills add hookdeck/webhook-skills --skill stripe-webhooks

# Install multiple webhook skills
npx skills add hookdeck/webhook-skills --skill stripe-webhooks --skill shopify-webhooks

Install with /plugin (Claude Code)

Claude Code distributes this repo as a plugin marketplace. Add the marketplace once, then install either a single provider skill or the bundle of all 40 skills.

# Add this marketplace
/plugin marketplace add hookdeck/webhook-skills

# Install one provider skill (each is ~200 KB)
/plugin install stripe-webhooks@webhook-skills

# Or install all 40 webhook skills as one bundle (~3 MB)
/plugin install webhook-skills@webhook-skills

Plugin skills are namespaced with their plugin name, so the bundle exposes skills as webhook-skills:stripe-webhooks, webhook-skills:shopify-webhooks, etc., while a granular install exposes the same skill as stripe-webhooks:stripe-webhooks.

Local Webhook Development

To receive webhooks on localhost during development, run Hookdeck CLI via npx — no install required:

# Start local webhook tunnel (no account required)
npx hookdeck-cli listen 3000 stripe --path /webhooks/stripe

This provides a public URL that forwards webhook events to your local server, plus a web UI for inspecting and replaying webhook requests.

Example: How to Handle Stripe Webhooks

If an agent receives a checkout.session.completed event from Stripe, the stripe-webhooks skill can:

  1. Verify the webhook signature using Stripe's signing secret
  2. Parse the event payload to extract checkout session data
  3. Return a normalized event object for further processing

After installing the skill, ask your AI assistant:

"Help me set up Stripe webhook handling in my Express app"

The agent will:

  1. Read stripe-webhooks/SKILL.md to understand webhook verification
  2. Reference stripe-webhooks/references/verification.md for signature verification details
  3. Copy code from stripe-webhooks/examples/express/ as a starting point
  4. Suggest npx hookdeck-cli listen 3000 stripe --path /webhooks/stripe for local webhook testing

Example: How to Verify GitHub Webhook Signatures

If an agent needs to verify GitHub webhook authenticity, the github-webhooks skill can:

  1. Extract the signature header (X-Hub-Signature-256)
  2. Compute HMAC-SHA256 of the raw request body
  3. Compare signatures using timing-safe comparison

Ask your AI assistant:

"How do I verify GitHub webhook signatures in Next.js?"

Skill Structure

Each webhook skill follows a consistent structure:

skills/{provider}-webhooks/
├── SKILL.md              # Entry point — webhook overview, when to use
├── references/           # Documentation loaded on-demand
│   ├── overview.md       # What webhooks are available, common events
│   ├── setup.md          # Provider dashboard configuration
│   └── verification.md   # Webhook signature verification details
└── examples/             # Runnable webhook handler examples
    ├── express/          # Express.js webhook handler
    ├── nextjs/           # Next.js API route webhook handler
    └── fastapi/          # FastAPI webhook handler

Examples are complete, runnable webhook handlers following PostHog's approach — minimal code that demonstrates webhook signature verification and event handling.

Contributing

We welcome contributions! The recommended way to add new provider webhook skills is using our AI-powered generator:

# One-time setup
cd scripts/skill-generator && npm install && cd ../..

# Generate a webhook skill (with documentation URL for best results)
./scripts/generate-skills.sh generate \
  "twilio=https://www.twilio.com/docs/usage/webhooks" \
  --create-pr

The generator researches the provider's webhook documentation, generates signature verification code and tests for Express/Next.js/FastAPI, validates accuracy, and creates a PR — all automatically.

See CONTRIBUTING.md for the complete guide, including:

  • Providing multiple documentation URLs for better webhook skill generation
  • Using YAML configs for batch webhook skill generation
  • Resuming failed generations with the review command
  • Updating existing webhook skills
  • Manual contribution guidelines

Related Resources

License

MIT

Files in the repo

Repository payload•11 top-level entries
  • .claude-plugin
  • .github
  • scripts
  • skills
  • .gitignore
  • AGENTS.md
  • CONTRIBUTING.md
  • LICENSE
  • providers.yaml
  • README.md
  • TESTING.md

Discussion (0)

Ask about usage, or say what you built with it

Sign in to join the discussion.

No comments yet. Be the first to say what this is good for.

More collections

VoltAgent/awesome-openclaw-skillsCollections

The awesome collection of OpenClaw skills. 5,400+ skills filtered and categorized from the official OpenClaw Skills Registry.🦞

52k
VoltAgent/awesome-agent-skillsCollections

A curated collection of 1000+ agent skills from official dev teams and the community, compatible with Claude Code, Codex, Gemini CLI, Cursor, and more.

34k