Webhook Skills

Hookdeck Outpost — open-source infrastructure for sending webhooks and events to user-preferred destinations (HTTP, SQS, RabbitMQ, Pub/Sub, EventBridge, Kafka). Use when building a SaaS platform that needs to deliver events to customers.

Receive and verify NMI (Network Merchants) webhooks. Use when setting up NMI webhook handlers, debugging Webhook-Signature verification, or handling transaction events like transaction.sale.success, transaction.auth.success, transaction.refund.success, and transaction.void.success. Note: NMI does NOT use Standard Webhooks — the Webhook-Signature header is "t=<nonce>,s=<sig>" (comma-separated) where t is a NONCE (not a Unix timestamp), and the signature is HMAC-SHA256 over "<nonce>.<raw_body>", lowercase hex.

Receive and verify Orb webhooks. Use when setting up Orb webhook handlers, debugging Orb signature verification, or handling usage-based billing events like invoice.issued, subscription.created, or customer.credit_balance_dropped.

Receive and verify Wix webhooks. Use when setting up Wix webhook handlers for self-hosted/self-managed apps, debugging JWT signature verification with your app's public key, or handling events like wix.ecom.v1.order_created, wix.ecom.v1.order_approved, wix.ecom.v1.order_updated, and wix.ecom.v1.order_canceled.

Receive and verify Clio (Clio Manage) webhooks. Use when setting up Clio webhook handlers, debugging X-Hook-Signature verification, completing the X-Hook-Secret handshake, or handling legal practice events like matter.created, contact.updated, activity.created, or bill events.

Receive and verify eBay Notification API webhooks (Platform Notifications / Event Notifications). Use when setting up an eBay webhook endpoint, passing the endpoint challenge validation, debugging the x-ebay-signature ECDSA verification, fetching the public key with getPublicKey, or handling events like MARKETPLACE_ACCOUNT_DELETION.

Receive and verify Jira Cloud webhooks. Use when setting up Jira webhook handlers, debugging signature verification, or handling issue and comment events like jira:issue_created, jira:issue_updated, jira:issue_deleted, comment_created, or comment_updated.

Receive and verify Neon Auth webhooks. Use when setting up Neon webhook handlers, debugging Ed25519 / detached JWS signature verification, or handling Neon Auth events like user.created, user.before_create, send.otp, send.magic_link, or phone_number.verified.

Receive and verify Okta Event Hooks. Use when setting up Okta event hook handlers, implementing the one-time verification challenge, authenticating requests with the Authorization header secret, or handling identity events like user.lifecycle.create, user.session.start, user.account.lock, or group.user_membership.add.

Receive and verify Oura webhooks. Use when setting up Oura Ring webhook handlers, completing the subscription verification handshake, debugging x-oura-signature verification, or handling data events like sleep, daily_readiness, daily_activity, and workout.

Receive and verify Svix webhooks (the Standard Webhooks scheme used by many providers). Use when setting up a Svix webhook handler, debugging svix-id / svix-timestamp / svix-signature verification, handling secret rotation with multiple signatures, or parsing the {"type": "...", "data": {...}} envelope for events like invoice.paid, user.created, or message.sent.

Receive and verify Uber Eats webhooks. Use when setting up Uber webhook handlers, debugging X-Uber-Signature verification, or handling order events like orders.notification, orders.cancel, store.provisioned, or store.status.changed.

Receive and verify USPS webhooks (Subscriptions - Tracking API v3.2). Use when setting up USPS tracking webhook handlers, debugging X-HMAC signature verification, creating tracking subscriptions, or handling package tracking events like Out for Delivery, Delivered, or Available for Pickup.

Receive and verify Vapi webhooks (the "Server URL"). Use when setting up a Vapi Server URL receiver, authenticating deliveries with a shared secret (Authorization: Bearer or the legacy X-Vapi-Secret header), or handling voice-agent server messages — including the four request/response types that REQUIRE a JSON body back (assistant-request, tool-calls, transfer-destination-request, knowledge-base-request) plus informational ones like status-update and end-of-call-report.

Receive and verify Xero webhooks. Use when setting up Xero webhook handlers, debugging x-xero-signature verification, passing Xero's Intent to Receive (ITR) validation, or handling accounting events like CONTACT/CREATE, INVOICE/UPDATE, CREDITNOTE, and SUBSCRIPTION changes.

Receive and acknowledge Zift (Zift Payments / payment gateway) webhook notifications. Use when setting up a Zift webhook receiver, understanding why there is no signature/HMAC header to verify, returning the required {"notificationId": ...} acknowledgement, or handling billing and processing events like billing.subscription-created, processing.chargeback, and processing.return.

Receive and verify Zoom webhooks. Use when setting up Zoom webhook handlers, debugging signature verification, completing the endpoint.url_validation handshake, or handling meeting and recording events like meeting.started, meeting.ended, meeting.participant_joined, or recording.completed.

Receive and verify Adyen webhooks (standard notifications). Use when setting up Adyen webhook handlers, debugging HMAC signature verification, or handling payment events like AUTHORISATION, CAPTURE, REFUND, CANCELLATION, and CHARGEBACK.

Receive and verify Asana webhooks. Use when setting up Asana webhook handlers, implementing the X-Hook-Secret handshake, debugging X-Hook-Signature verification, or handling task, project, and story events like added, changed, removed, deleted, and undeleted.

Receive and verify Ashby webhooks. Use when setting up Ashby webhook handlers, debugging Ashby-Signature verification, or handling recruiting events like applicationSubmit, candidateHire, candidateStageChange, or interviewScheduleCreate.

Receive and verify Auth0 webhooks delivered via Custom Log Streams (HTTP). Use when setting up an Auth0 log stream HTTP endpoint, validating the configured Authorization token, or handling batched authentication log events like s (success login), f (failed login), ss (signup), and sepft (token exchange / MFA).

Receive and verify Clerk webhooks. Use when setting up Clerk webhook handlers, debugging signature verification, or handling user events like user.created, user.updated, session.created, or organization.created.

Receive and verify Enode webhooks. Use when setting up Enode webhook handlers, debugging signature verification, or handling EV and energy events like user:vehicle:updated, user:charger:updated, or user:battery:updated.

Receive and verify Favro webhooks. Use when setting up Favro webhook handlers, debugging X-Favro-Webhook signature verification, accepting the setup ping, or handling card events (card.created, card.committed, card.moved, card.updated, card.deleted) and comment events (comment.created, comment.updated, comment.deleted). Note: Favro does NOT use Standard Webhooks — the signature is base64(HMAC-SHA1(secret, payloadId + the URL you registered)), signed over the payloadId concatenated with the target URL, NOT the raw request body.

Receive and verify Knock outbound webhooks. Use when setting up Knock webhook handlers, debugging x-knock-signature verification, or handling notification events like message.sent, message.delivered, message.bounced, message.read, workflow.committed, or message.link_clicked.

Receive and verify Nylas webhooks. Use when setting up Nylas webhook handlers, debugging x-nylas-signature verification, completing the challenge handshake, or handling email and calendar events like message.created, message.opened, event.created, event.updated, or grant.expired.

Receive and verify Polar webhooks. Use when setting up Polar webhook handlers, debugging Standard Webhooks signature verification, or handling billing events like order.paid, subscription.created, subscription.canceled, or checkout.updated.

Receive and verify Pylon webhooks. Use when setting up Pylon webhook handlers, debugging Pylon signature verification (Pylon-Webhook-Signature, hs256= HMAC-SHA256 over timestamp.body), or handling B2B support events such as issue lifecycle changes (Pylon's event-type catalog is not public — confirm the exact names in your own destination configuration).

Receive and verify Slack Events API webhooks. Use when setting up Slack webhook handlers, debugging Slack signature verification, handling the url_verification challenge, or processing events like app_mention, message, reaction_added, team_join, or app_home_opened.

Receive and verify Smile API (getsmileapi.com) webhooks. Use when setting up a Smile webhook endpoint, verifying the Smile-Signature header (HMAC-SHA512 hex over the raw body), debugging Smile signature verification failures, or handling employment/income data events like ACCOUNT_CONNECTED, TASK_FINISHED, INCOMES_ADDED, EMPLOYMENTS_ADDED, IDENTITY_ADDED, and RECORD_COMPLETED. This is Smile API for Southeast Asian employment/income data — NOT Smile.io loyalty and NOT Smile Identity KYC.

Receive and verify Tally webhooks. Use when setting up Tally form webhook handlers, debugging Tally-Signature verification, or handling FORM_RESPONSE submission events and reading answers from data.fields.

Receive and verify Tebex webhooks. Use when setting up Tebex webhook handlers, debugging X-Signature verification, completing the validation.webhook handshake, or handling events like payment.completed, payment.refunded, and recurring-payment.renewed.

Receive and verify Utila webhooks. Use when setting up Utila webhook handlers, debugging x-utila-signature RSA/PSS verification, or handling Utila digital-asset events like TRANSACTION_CREATED, TRANSACTION_STATE_UPDATED, WALLET_CREATED, WALLET_ADDRESS_CREATED, and TRANSACTION_AML_SCREENING_RESULT_READY.

Receive and verify Akeneo PIM (Events API) webhooks. Use when setting up Akeneo webhook handlers, debugging x-akeneo-request-signature verification, or handling batched product and product-model events like product.created, product.updated, product.removed, product_model.created, product_model.updated, or product_model.removed.

Receive and verify Alipay (Antom / Alipay+) webhook notifications. Use when setting up Alipay webhook handlers, debugging RSA256 Signature header verification, or handling payment events like notifyPayment, notifyCapture, notifyRefund, notifyAuthorization, and notifyDispute.

Receive and verify Ascend webhooks. Use when setting up Ascend webhook handlers, debugging Ascend signature verification (X-Ascend-Signature, HMAC-SHA256), or handling insurance payment events like invoice.paid, payout.paid, and refund.paid.

Receive and verify Circle Payments Network (CPN) v2 webhooks. Use when setting up Circle webhook handlers, debugging ECDSA signature verification (X-Circle-Signature, X-Circle-Key-Id), or handling notifications like cpn.payment.*, cpn.transaction.*, and cpn.rfi.*.

Receive and verify Cursor Cloud Agent webhooks. Use when setting up Cursor webhook handlers, debugging signature verification, or handling Cloud Agent status change events (ERROR, FINISHED).

Receive and verify Ethoca (Mastercard) Alerts webhooks. Use when setting up an Ethoca Alerts Push API receiver, securing the endpoint (mTLS, with optional onboarding-agreed HTTP Basic Auth; no HMAC signature), or handling fraud and dispute alert notifications.

Receive and verify Google Gemini API webhooks. Use when setting up Gemini webhook handlers for batch jobs, video generation, or Interactions API function-calling LROs, debugging signature verification, or handling events like batch.succeeded, batch.failed, video.generated, or interaction.completed.

Receive and verify GitHub webhooks. Use when setting up GitHub webhook handlers, debugging signature verification, or handling repository events like push, pull_request, issues, or release.

Receive and verify GitLab webhooks. Use when setting up GitLab webhook handlers, debugging token verification, or handling repository events like push, merge_request, issue, pipeline, or release.

Receive and verify Linear webhooks. Use when setting up Linear webhook handlers, debugging Linear signature verification, or handling Linear issue tracking events like Issue, Comment, Project, Cycle, IssueLabel, and IssueSLA create/update/remove actions.

Receive and verify Lithic webhooks. Use when setting up Lithic event subscriptions, debugging Standard Webhooks signature verification, or handling card and money-movement events like card.created, card_transaction.updated, payment_transaction.created, and dispute.updated.

Receive and verify Cisco Meraki Dashboard webhook alerts. Use when setting up Meraki webhook handlers, validating the sharedSecret, or handling alert events like motion_alert, settings_changed, sensor_alert, or stopped_reporting.

Receive and handle Mollie webhooks. Use when setting up Mollie webhook handlers, understanding why Mollie webhooks are not signed, or handling payment status changes like paid, expired, failed, canceled, or authorized. Teaches the fetch-to-confirm pattern: the webhook only sends a payment id, so you fetch the payment from the Mollie API to read its authoritative status.

Receive and verify monday.com webhooks. Use when setting up monday.com webhook handlers, implementing the challenge handshake, debugging JWT verification, or handling board events like create_item, change_column_value, change_status_column_value, create_update, or create_subitem.

Receive and verify Notion webhooks. Use when setting up Notion webhook handlers, debugging Notion signature verification, completing the verification_token handshake, or handling workspace events like page.content_updated, page.properties_updated, comment.created, or data_source.schema_updated.

Receive and verify OpenAI webhooks. Use when setting up OpenAI webhook handlers for fine-tuning jobs, batch completions, or async events like fine_tuning.job.completed, batch.completed, or realtime.call.incoming.

Receive and verify Paddle webhooks. Use when setting up Paddle webhook handlers, debugging signature verification, or handling subscription events like subscription.created, subscription.canceled, or transaction.completed.

Receive and verify Paymob webhook callbacks (transaction callbacks). Use when setting up Paymob webhook handlers, debugging HMAC-SHA512 signature verification, or handling payment transaction states like success, refund, void, and auth/capture from the Transaction Processed Callback.

Receive and verify PayPal webhooks. Use when setting up PayPal webhook handlers, debugging certificate-based signature verification, or handling payment events like PAYMENT.CAPTURE.COMPLETED, PAYMENT.SALE.COMPLETED, BILLING.SUBSCRIPTION.CREATED, or CHECKOUT.ORDER.APPROVED.

Receive and verify Picqer webhooks. Use when setting up Picqer webhook handlers, debugging X-Picqer-Signature verification, or handling warehouse and order events like orders.completed, picklists.closed, or products.stock_changed.

Receive and verify Praxis (Praxis Tech / Cashier payment orchestration) webhooks. Use when setting up a Praxis webhook endpoint, verifying the gt-authentication SHA-384 signature, signing the acknowledgement with the external-request-signature header, or handling Payment Notification (transaction_status pending, approved, rejected, error) and Subscription Notification events.

Receive and verify Quoter webhooks. Use when setting up Quoter webhook handlers, debugging the MD5 hash verification, or handling Quote, Person, and Payment create/update events posted as x-www-form-urlencoded.

Receive and verify Resend webhooks. Use when setting up Resend webhook handlers, debugging signature verification, handling email events like email.sent, email.delivered, email.bounced, or processing inbound emails.

Receive and verify Retell AI webhooks. Use when setting up Retell webhook handlers, debugging X-Retell-Signature verification, or handling voice call events like call_started, call_ended, call_analyzed, and transcript_updated.

Receive and verify Sanity GROQ-powered webhooks. Use when setting up Sanity webhook handlers, debugging signature verification with the sanity-webhook-signature header, or handling Content Lake document create/update/delete events for cache revalidation and search reindexing.

Receive and verify Square webhooks. Use when setting up Square webhook handlers, debugging Square signature verification, or handling payment and commerce events like payment.created, payment.updated, refund.created, invoice.payment_made, or order.updated.

Receive and verify Strava webhooks (Webhook Events API). Use when setting up Strava push subscriptions, implementing the GET subscription validation handshake, debugging the hub.challenge / hub.verify_token exchange, or handling activity and athlete events like activity create, activity update, activity delete, and athlete deauthorization.