Webhook Skills

Receive and verify Bitbucket Cloud webhooks. Use when setting up Bitbucket webhook handlers, debugging X-Hub-Signature verification, or handling repository and pull request events like repo:push, pullrequest:created, pullrequest:updated, pullrequest:fulfilled, or pullrequest:rejected.

Receive and verify Chargebee webhooks. Use when setting up Chargebee webhook handlers, debugging Basic Auth verification, or handling subscription billing events.

Receive and verify Community (community.com) SMS platform webhooks. Use when setting up a Community webhook handler, debugging `community-signature` HMAC-SHA256 verification, or handling message.inbound, message.outbound, member.created, member.updated, and member.deleted events.

Receive and verify Fireflies.ai webhooks. Use when setting up Fireflies webhook handlers, debugging X-Hub-Signature verification, or handling the meeting.transcribed, meeting.summarized, and meeting.bot_joined events from Webhooks V2. Also covers the legacy V1 scheme.

Receive and secure Mailchimp webhooks. Use when setting up Mailchimp webhook handlers, responding to Mailchimp's GET URL validation, securing the endpoint with a URL secret, or handling audience events like subscribe, unsubscribe, profile, upemail, cleaned, and campaign.

Receive and verify Nuvemshop (Tiendanube) webhooks. Use when setting up Nuvemshop webhook handlers, debugging x-linkedstore-hmac-sha256 signature verification, or handling store events like order/created, order/paid, order/cancelled, product/updated, or app/uninstalled.

Receive and authenticate Pipedrive webhooks. Use when setting up Pipedrive webhook handlers, debugging HTTP Basic Auth verification, or handling CRM events like create.deal, change.person, or delete.activity.

Receive and verify Replicate webhooks. Use when setting up Replicate webhook handlers, debugging signature verification, or handling prediction events like start, output, logs, or completed.

Receive and verify Solidgate webhooks. Use when setting up Solidgate webhook handlers, debugging signature verification with the merchant and signature headers, or handling payment events like card_gate.order.updated, card_gate.chargeback.received, subscription.updated.v2, or alt_gate.order.updated.

Receive BaseLinker (Base.com) webhooks. Use when building a BaseLinker order or warehouse callback receiver, because BaseLinker is not a normal webhook source: deliveries arrive as HTTP HEAD requests with NO body, the entire payload is in the query string (observed params: order_id, state), there is NO signature verification of any kind (no HMAC, no secret, no handshake), and your response must be a bare bodyless 200. Use when debugging an empty req.body, wiring app.head / an exported HEAD route handler / @app.head, or polling getJournalList for change tracking.

Receive and verify Bridge API webhooks (bridgeapi.io — the open-banking aggregator by Bridge/Bankin', NOT bridge.xyz). Use when setting up Bridge API webhook handlers, debugging BridgeApi-Signature HMAC-SHA256 verification, or handling events like item.created, item.refreshed, item.account.updated, payment.transaction.created, or user.deleted.

Receive and verify Bridge (bridge.xyz) webhooks. Use when setting up Bridge webhook handlers, debugging RSA signature verification of the X-Webhook-Signature header, or handling stablecoin/fiat events like customer.updated, kyc_link.updated, transfer.updated, and virtual_account.activity.

Receive and verify Cloudinary webhooks (notifications). Use when setting up a Cloudinary notification receiver, verifying the x-cld-signature and x-cld-timestamp headers with the official cloudinary SDK, debugging Cloudinary signature verification failures, or handling notification_type events like upload, eager, delete, rename, moderation, and resource_tags_changed.

Receive and verify Customer.io Reporting Webhooks. Use when setting up Customer.io webhook handlers, debugging X-CIO-Signature verification, or handling messaging events like email delivered, email opened, email clicked, email bounced, sms sent, push delivered, or customer unsubscribed.

Receive and verify ElevenLabs webhooks. Use when setting up ElevenLabs webhook handlers, debugging signature verification, or handling call transcription events.

Receive and verify FastSpring webhooks. Use when setting up FastSpring webhook handlers, debugging X-FS-Signature verification, or handling ecommerce events like order.completed, subscription.activated, subscription.charge.completed, and subscription.canceled.

Receive and verify Fireblocks webhooks. Use when setting up Fireblocks webhook handlers, debugging Fireblocks-Webhook-Signature verification (detached JWS / RS512 / JWKS), or handling digital-asset events like transaction.created, transaction.status.updated, or transaction.approval_status.updated.

Receive and verify FusionAuth webhooks. Use when setting up FusionAuth webhook handlers, debugging JWT signature verification, or handling authentication events like user.create, user.login.success, user.registration.create, or user.delete.

Receive and verify GoCardless webhooks. Use when setting up GoCardless webhook handlers, debugging Webhook-Signature verification, or handling bank debit events like payments confirmed, payments failed, mandates cancelled, and payouts paid.

Receive and verify MailerSend webhooks. Use when setting up MailerSend webhook handlers, debugging MailerSend signature verification with the `Signature` header (HMAC-SHA256 hex over the raw body), handling the `webhook.test` URL validation ping, or handling MailerSend activity events like activity.sent, activity.delivered, activity.hard_bounced, activity.opened, activity.clicked and activity.spam_complaint. Also covers MailerSend SMS webhooks (sms.sent, sms.delivered, sms.failed). MailerSend is the transactional email/SMS API — not MailerLite, Mailgun, Mailchimp or Resend.

Receive and verify Salesforce Outbound Messages (the native "webhook" for Flow/Workflow). Use when setting up a Salesforce Outbound Message listener, parsing the SOAP/XML notification, validating the OrganizationId, returning the required Ack response, or handling Account, Contact, Lead, Opportunity, and Case record changes. Also covers Platform Events / Change Data Capture as the streaming alternative.

Receive and verify BigCommerce webhooks. Use when setting up BigCommerce webhook handlers, debugging Standard Webhooks signature verification, or handling store events like store/order/created, store/order/statusUpdated, store/product/updated, or store/cart/abandoned.

Receive and verify CloudSignal webhooks from Cloudprinter.com. Use when setting up a CloudSignal Webhooks v2.0 receiver, authenticating deliveries by the plaintext `apikey` field in the JSON body (there is NO HMAC signature header), or handling print order/item status signals like CloudprinterOrderValidated, ItemProduced, ItemShipped, ItemError, and ItemCanceled.

Receive and verify RingCentral webhooks. Use when setting up RingCentral webhook subscriptions, completing the Validation-Token handshake, checking the Verification-Token header, or handling message-store, presence, and telephony session events.

Receive and verify ShipStation webhooks. Use when setting up ShipStation webhook handlers, securing endpoints that have no signature (secret token in the URL), fetching the thin resource_url payload with Basic auth, or handling ORDER_NOTIFY, ITEM_ORDER_NOTIFY, SHIP_NOTIFY, ITEM_SHIP_NOTIFY, FULFILLMENT_SHIPPED, and FULFILLMENT_REJECTED events.

Receive and verify TikTok Shop webhooks. Use when setting up TikTok Shop webhook handlers, debugging Authorization-header signature verification, or handling events like ORDER_STATUS_CHANGE, PACKAGE_UPDATE, RECIPIENT_ADDRESS_UPDATE, PRODUCT_STATUS_CHANGE, or SELLER_DEAUTHORIZATION.

Receive and verify WooCommerce webhooks. Use when setting up WooCommerce webhook handlers, debugging signature verification, or handling e-commerce events like order.created, order.updated, product.created, or customer.created.

Receive and verify Bunny Stream webhooks. Use when setting up Bunny Stream webhook handlers, debugging X-BunnyStream-Signature verification, or handling video encoding events like Status 3 (Finished / encoding done), Status 5 (Failed), or captions and title/description generation.

Receive and verify Exact Online webhooks. Use when setting up Exact Online webhook handlers, debugging HashCode signature verification, subscribing to topics via the WebhookSubscriptions REST endpoint, or handling entity change events like Accounts, Items, StockPositions, FinancialTransactions, GoodsDeliveries, and Contacts. Note: Exact does NOT use Standard Webhooks — the signature is a HashCode field inside the JSON body (HMAC-SHA256 over the Content node, hex, uppercased), not an HTTP header.

Receive and verify Commerce Layer webhooks. Use when setting up Commerce Layer webhook handlers, debugging X-CommerceLayer-Signature verification, or handling commerce events like orders.place, orders.approve, orders.pay, or shipments.ship.

Receive and verify Google Cloud Pub/Sub push subscription webhooks. Use when setting up a Pub/Sub push endpoint, verifying the OIDC `Authorization: Bearer` JWT that Pub/Sub attaches to authenticated push subscriptions (iss, aud, email, email_verified), parsing the push envelope (`message.data` base64, `message.attributes`, `messageId`, `publishTime`, `subscription`), securing an unauthenticated push endpoint, or debugging redelivery and ack deadline issues.

Hookdeck Event Gateway — webhook infrastructure that replaces your queue. Use when receiving webhooks and need guaranteed delivery, automatic retries, replay, rate limiting, filtering, or observability. Eliminates the need for your own message queue for webhook processing.

Receive and verify PayPro Global IPN (Instant Payment Notification) webhooks. Use when setting up a PayPro Global IPN handler, debugging the SIGNATURE (SHA256) or HASH (MD5) verification, or handling order and subscription events like OrderCharged, OrderRefunded, and SubscriptionChargeSucceed. Payloads are form-encoded (application/x-www-form-urlencoded), not JSON.

Receive and verify Microsoft Graph change notifications (webhooks). Use when setting up a Microsoft Graph webhook / subscription handler, completing the validationToken endpoint validation handshake, validating clientState, decrypting rich notifications (includeResourceData), handling lifecycle events (reauthorizationRequired, subscriptionRemoved, missed), or processing created/updated/deleted change notifications for Outlook mail, Teams messages, OneDrive/SharePoint driveItems, users, and groups.

Receive and validate Azure Event Grid webhook deliveries. Use when setting up an Event Grid WebHook event handler, implementing the Microsoft.EventGrid.SubscriptionValidationEvent handshake (echo data.validationCode as validationResponse with HTTP 200), implementing the CloudEvents v1.0 HTTP OPTIONS abuse-protection preflight (WebHook-Request-Origin / WebHook-Allowed-Origin), checking the aeg-subscription-name / aeg-event-type / aeg-delivery-count headers, authenticating deliveries with a static delivery-property header or a Microsoft Entra ID bearer token, parsing Event Grid schema arrays vs CloudEvents objects, or handling events like Microsoft.Storage.BlobCreated. Event Grid does NOT sign the request body — there is no HMAC signature.

Receive and verify Coinbase Commerce webhooks. Use when setting up Coinbase Commerce webhook handlers, debugging X-CC-Webhook-Signature verification, or handling cryptocurrency payment events like charge:created, charge:confirmed, charge:failed, charge:pending, charge:delayed, and charge:resolved.

Receive and verify Vercel Log Drains deliveries. Use when setting up a Vercel log drain HTTP endpoint, debugging x-vercel-signature verification, handling the x-vercel-verify endpoint handshake, or processing batched log entries from sources like lambda, edge, build, static, external, firewall, and redirect.

Receive and verify Microsoft SharePoint webhooks. Use when setting up SharePoint list/document-library webhook handlers, completing the validationtoken handshake, validating clientState, or reacting to list-item changes like ItemAdded/ItemUpdated by calling the GetChanges API.

Receive and verify Anthropic Claude Managed Agents (CMA) webhooks. Use when setting up Claude Managed Agents webhook handlers, debugging signature verification, or handling agent session and vault events like session.status_idled, session.status_terminated, session.thread_created, vault.created, or vault_credential.refresh_failed.

Verify and handle webhooks delivered through the Hookdeck Event Gateway. Use when receiving webhooks via Hookdeck and need to verify the x-hookdeck-signature header. Covers signature verification for Express, Next.js, and FastAPI.