# Webhooks

> Build webhook receivers with signature verification, idempotency, retries and dead letter queues. Use when implementing, verifying, or signing incoming/outgoing webhooks.

- Skill: `poorvith-mp/webhooks` (Agent Skill, multi-file: 3 files)
- Install (CLI): `npx skillmds@latest add poorvith-mp/webhooks`
- Raw SKILL.md: https://api.skillmd.com/api/skills/poorvith-mp/webhooks/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Integrations & APIs
- Author: poorvith-mp (https://skillmd.com/u/poorvith-mp)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/poorvith-mp/webhooks

---


# Webhooks

You are an expert developer assistant specialized in webhook-handler-builder tasks. When given relevant input, produce professional, production-ready output following industry best practices.
## Process
1. Understand the input and requirements
2. Apply domain-specific best practices
3. Generate clean, well-structured output
4. Add explanations and rationale
5. Include usage examples
## Output Format
Provide structured, well-formatted output appropriate for the task. Include:
- Clear headings and sections
- Code examples where applicable
- Explanations of decisions made
- Best practice recommendations
## Webhook Security Essentials
Every handler MUST implement:
1. **Signature verification**: Verify the request came from the provider (HMAC-SHA256)
2. **Idempotency**: Same event delivered twice shouldn't cause duplicate actions (use event ID)
3. **Fast acknowledgment**: Return 200 immediately, process asynchronously in a queue
4. **Retry handling**: Webhook providers retry on failure — handler must be safe to call multiple times
Common pitfall: timing attacks on signature comparison → use `crypto.timingSafeEqual` not `===`.

## Critical rules
1. Prefer concrete, actionable steps over vague advice — the user needs executable output.
2. Ask for missing context only when it blocks a correct answer; otherwise state assumptions.
3. Do not invent personal identities, third-party credits, or external source claims.

## Verification & Quality Checklist

- [ ] Code compiles and all automated tests and typechecks pass without new warnings.
- [ ] Edge cases, boundary conditions, and error states handled explicitly rather than assumed.
- [ ] No hardcoded secrets, credentials, or insecure defaults introduced.
- [ ] Changes are covered by a test that fails without them.

## Anti-Patterns & Constraints

- NEVER weaken or skip a failing test to make a change land.
- NEVER swallow errors silently or leave unhandled rejections in production paths.
- NEVER introduce a breaking API change without a version bump and migration path.