This repository contains webhook-related skills for AI coding agents that need to receive, verify signatures, handle events, retry deliveries, or debug webhook integrations from various providers (see Provider Webhook Skills table below).
Skills provide step-by-step instructions, signature verification code, and runnable examples for Express, Next.js, and FastAPI.
Works with Claude Code, Cursor, VS Code Copilot, and other AI coding assistants that support the Agent Skills specification.
Use these webhook skills when:
- You need to receive webhooks from third-party providers (Stripe, Shopify, GitHub, etc.)
- You need to verify webhook signatures to ensure authenticity
- You need to handle webhook event payloads and extract data
- You need to implement idempotency for webhook handlers
- You need to retry or replay failed webhook deliveries
- You need provider-specific webhook handling logic (e.g., Stripe checkout events, GitHub push events)
These skills are designed to be discoverable by agents using skill registries and tools like find-skills, where an agent searches for webhook-related capabilities by provider or task.
Skills for receiving and verifying webhooks from specific providers. Each includes setup guides, webhook signature verification, and runnable examples.
| Provider | Skill | What It Does |
|---|---|---|
| 100ms | 100ms-webhooks |
Authenticate 100ms webhooks (unsigned: a secret header you set in the dashboard, compared in constant time), handle peer, session, recording and HLS events |
| 1Password Device Trust (Kolide) | kolide-webhooks |
Verify 1Password Device Trust (Kolide) webhooks (Authorization: hex HMAC-SHA256 of the raw body), handle device, issue, audit and auth events |
| 360dialog | 360dialog-webhooks |
Authenticate 360dialog WhatsApp webhooks (unsigned HTTP Basic auth set in the webhook headers, compared in constant time), handle inbound messages and status updates |
| 8x8 | 8x8-webhooks |
Authenticate 8x8 Connect webhooks (unsigned: the whole Authorization value, Bearer or Basic, compared in constant time), handle eventTypes like inbound_message_received, outbound_message_status_changed and short_url_clicked |
| Ably | ably-webhooks |
Verify Ably webhook signatures (X-Ably-Signature, HMAC-SHA256 base64 of the raw body keyed with the API key's secret part), handle channel.message, channel.presence and channel.lifecycle events |
| Absorb LMS | absorb-lms-webhooks |
Verify Absorb LMS webhook signatures (absorb-signature, HMAC-SHA256 hex of the raw body), handle UserCreated and CertificateAwarded events |
| Act-On | act-on-webhooks |
Verify Act-On outgoing webhooks (delivered by Svix: svix-id, svix-timestamp, svix-signature, whsec_ Signing Secret), handle contact, form, bounce and subscription events |
| Acuity Scheduling | acuity-scheduling-webhooks |
Verify Acuity Scheduling webhook signatures (X-Acuity-Signature, HMAC-SHA256 base64 of the raw form-encoded body keyed with the API key), handle appointment actions like scheduled, rescheduled, canceled and changed |
| Acumatica | acumatica-webhooks |
Authenticate Acumatica push notifications (unsigned: a secret header compared in full in constant time), handle Inserted and Deleted row changes |
| Ada | ada-webhooks |
Verify Ada (ada.cx) AI customer service webhooks delivered via Svix (svix-id/svix-timestamp/svix-signature, HMAC-SHA256 base64 over {id}.{timestamp}.{raw body}, per-endpoint whsec_ secret), handle conversation, end-user, audit log and proactive call events |
| Adyen | adyen-webhooks |
Verify Adyen webhook HMAC signatures (additionalData.hmacSignature), handle AUTHORISATION, CAPTURE, and REFUND notifications |
| Affonso | affonso-webhooks |
Verify Affonso webhooks (X-Affonso-Signature: hex HMAC-SHA256 of {X-Affonso-Timestamp}.{body}), handle affiliate, referral, transaction and payout events |
| AfterShip | aftership-webhooks |
Verify AfterShip webhook signatures (HMAC-SHA256, base64, over the raw body) across all three product headers — aftership-hmac-sha256 (Tracking), as-signature-hmac-sha256 (Returns/Warranty) and am-webhook-signature (Shipping/Postmen, hmac-sha256= prefixed) — handle Tracking events tracking_update, edd_revise and tracking_pending_time routed on msg.tag, plus Returns, Warranty and Shipping events |
| Agentcard | agentcard-webhooks |
Verify Agentcard webhook signatures (AgentCard-Signature t=<ts>,v1=<hex>, HMAC-SHA256 over {t}.{body} keyed with the whole whsec_ secret; not Standard Webhooks), handle card.created, transaction.authorized, approval.requested, and balance.low events |
| AgentLine | agentline-webhooks |
Verify AgentLine webhook signatures (X-Webhook-Signature, HMAC-SHA256 hex of the raw body), handle call and SMS events like call.completed and sms.received |
| AgentMail | agentmail-webhooks |
Verify AgentMail (Svix) webhook signatures, handle inbound email (message.received), delivery, bounce and complaint events |
| Agentset | agentset-webhooks |
Verify Agentset webhooks (agentset-signature: hex HMAC-SHA256 of the raw body), handle document and ingest job events |
| Agntix | agntix-webhooks |
Verify Agntix webhooks (delivered by Svix: svix-id, svix-timestamp, svix-signature, whsec_ secret), handle session.created and session.ended events |
| Agora | agora-webhooks |
Verify Agora webhooks (Agora-Signature: hex HMAC-SHA1 of the raw body), handle RTC channel events (by numeric eventType) |
| Aimfox | aimfox-webhooks |
Authenticate Aimfox webhooks (unsigned: the authentication header compared in full in constant time), handle event_types like new_connection, new_reply and account_logged_out |
| AiPrise | aiprise-webhooks |
Verify AiPrise identity/KYC/KYB callback signatures (X-HMAC-SIGNATURE, HMAC-SHA256 hex keyed with your API private key), handle APPROVED, DECLINED, REVIEW, and UNKNOWN verification results |
| Aircall | aircall-webhooks |
Verify Aircall webhooks by timing-safe comparison of the token field in the JSON body (no signature header, no HMAC), handle cloud phone events like call.created, call.answered, call.ended, message.received, contact.updated, and user.connected.v2 |
| Airtable | airtable-webhooks |
Verify Airtable webhook pings (X-Airtable-Content-MAC, HMAC-SHA256), fetch payloads with a cursor, manage 7-day webhook expiry |
| Airwallex | airwallex-webhooks |
Verify Airwallex webhook signatures (x-signature / x-timestamp, HMAC-SHA256 hex over timestamp + raw body), handle payment_intent, payment_attempt, refund, payment_consent, and payment_dispute events |
| Airweave | airweave-webhooks |
Verify Airweave webhooks (delivered by Svix: svix-id, svix-timestamp, svix-signature, whsec_ secret), handle sync, source connection and collection events |
| Akeneo | akeneo-webhooks |
Verify Akeneo PIM Events API webhook signatures (x-akeneo-request-signature, HMAC-SHA256 hex over timestamp.body), handle batched product and product-model events like product.created, product.updated, product.removed, product_model.created, product_model.updated, and product_model.removed |
| Alchemy | alchemy-webhooks |
Verify Alchemy Notify webhook signatures (X-Alchemy-Signature, HMAC-SHA256 hex over the raw body), handle ADDRESS_ACTIVITY, NFT_ACTIVITY, and GRAPHQL events |
| Alipay | alipay-webhooks |
Verify Alipay (Antom / Alipay+) webhook signatures (Signature header, RSA256 / SHA256withRSA, base64URL over <METHOD> <URI>\n<Client-Id>.<Request-Time>.<body>), sign the acknowledgement response, handle notifyPayment, notifyCapture, notifyRefund, notifyAuthorization, and notifyDispute events |
| Amazon EventBridge | aws-eventbridge-webhooks |
Authenticate Amazon EventBridge API destination calls (unsigned Basic auth connection, compared in constant time), handle forwarded events by source and detail-type |
| Ampersand | ampersand-webhooks |
Verify Ampersand webhooks (delivered by Svix: svix-id, svix-timestamp, svix-signature, whsec_ secret), handle installation, connection and read/write notifications and read results |
| Amplitude | amplitude-webhooks |
Authenticate Amplitude webhook streaming destinations (unsigned: a secret header compared in full in constant time), handle forwarded events and user property updates |
| Anarlog | anarlog-webhooks |
Verify Anarlog webhook signatures (x-anarlog-signature sha256=<hex>, HMAC-SHA256 of the raw body keyed with the whole whsec_ secret; not Standard Webhooks), handle meeting.completed and note.enhanced events |
| api.video | api-video-webhooks |
Verify api.video webhooks (X-Api-Video-Signature: hex HMAC-SHA256 of the raw body), handle video encoding and live stream events |
| Apify | apify-webhooks |
Authenticate Apify webhooks (unsigned: a secret header from the Headers template, compared in full in constant time), handle eventTypes like ACTOR.RUN.SUCCEEDED and ACTOR.RUN.FAILED |
| AppsFlyer | appsflyer-webhooks |
Authenticate AppsFlyer Push API (raw data) webhooks (no signature: constant-time compare of the custom authorization header you configure per app ID), handle install and in-app events such as af_purchase |
| Appstle Subscriptions | appstle-webhooks |
Verify Appstle Subscriptions webhooks (Svix: svix-id, svix-timestamp, svix-signature, whsec_ secret), handle subscription.created and subscription.billing-failure events |
| Arcadia | arcadia-webhooks |
Authenticate Arcadia utility data webhooks (unsigned: a custom header Arcadia support sets, compared in constant time), handle status, data and credential events |
| Ardoq | ardoq-webhooks |
Verify Ardoq webhooks (X-Ardoq-Signature-256: sha256= hex HMAC-SHA256 of {X-Ardoq-Timestamp}.{body}), handle component, reference and tag changes |
| Argil | argil-webhooks |
Verify Argil webhook signatures (Standard Webhooks: webhook-id, webhook-timestamp, webhook-signature, HMAC-SHA256, whsec_ secret), handle VIDEO_GENERATION_SUCCESS and AVATAR_TRAINING_SUCCESS events |
| Argo CD | argo-cd-webhooks |
Authenticate Argo CD notification webhooks (unsigned: a header you configure, compared in constant time), accept GET or POST, handle template-defined sync and health payloads |
| Argyle | argyle-webhooks |
Verify Argyle webhooks (X-Argyle-Signature: hex HMAC-SHA512 of the raw body), handle accounts.connected, accounts.failed and gigs.fully_synced events |
| Asaas | asaas-webhooks |
Authenticate Asaas (Brazilian payments) webhooks with the asaas-access-token header (no signature, constant-time authToken compare), dedupe on event id, handle PAYMENT_CREATED, PAYMENT_CONFIRMED, PAYMENT_RECEIVED, and PAYMENT_OVERDUE events |
| Asana | asana-webhooks |
Complete the Asana X-Hook-Secret handshake, verify X-Hook-Signature (HMAC-SHA256), handle batched compact events and heartbeats |
| Ascend | ascend-webhooks |
Verify Ascend insurance-payment webhook signatures (X-Ascend-Signature, HMAC-SHA256 hex over <timestamp>:<raw_body>), handle invoice.paid, invoice.voided, payout.paid, and refund.paid events |
| Ashby | ashby-webhooks |
Verify Ashby webhook signatures (Ashby-Signature, HMAC-SHA256 hex over the raw body), handle recruiting events like applicationSubmit, candidateHire, candidateStageChange, and interviewScheduleCreate |
| AssemblyAI | assemblyai-webhooks |
Authenticate AssemblyAI transcript webhooks (the custom webhook_auth_header_name / webhook_auth_header_value header compared in constant time), handle completed and error transcript status events |
| athenahealth | athenahealth-webhooks |
Verify athenahealth FHIR subscription notifications (X-Hub-Signature sha256=<hex>, HMAC-SHA256 of the raw body keyed with your X-Hub-Secret), handle appointment topics like Appointment.schedule |
| Attentive | attentive-webhooks |
Verify Attentive webhook signatures (x-attentive-hmac-sha256, HMAC-SHA256 hex), handle SMS and email subscriber events |
| Attio | attio-webhooks |
Verify Attio CRM webhook signatures (Attio-Signature, HMAC-SHA256 hex over the raw body), deduplicate on Idempotency-Key, handle record.created, record.updated, list-entry.created, list-entry.updated, note.created, and task.created events |
| Aurora Solar | aurora-solar-webhooks |
Authenticate Aurora Solar webhooks (unsigned GET requests: the header_auth_key header compared in constant time), read event data from the query string |
| Auth0 | auth0-webhooks |
Authenticate Auth0 Custom Log Stream deliveries (Authorization token), handle batched login and signup log events |
| Authgear | authgear-webhooks |
Verify Authgear webhooks (x-authgear-body-signature: hex HMAC-SHA256 of the raw body), handle non-blocking user and identity events |
| Autosana | autosana-webhooks |
Verify Autosana webhook signatures (X-Autosana-Signature-256: sha256=<hex>, HMAC-SHA256 of the raw body), handle batch.completed events |
| Autotask | autotask-webhooks |
Verify Autotask webhook signatures (X-Hook-Signature sha1=<base64>, HMAC-SHA1 of the raw body keyed with the webhook SecretKey), handle entity Create/Update/Delete callouts |
| Autumn | autumn-webhooks |
Verify Autumn (Svix) webhook signatures (svix-id, svix-timestamp, svix-signature, HMAC-SHA256), handle billing.updated, balances.limit_reached and billing.auto_topup_failed events |
| Auvik | auvik-webhooks |
Authenticate Auvik alert webhooks (unsigned: a header compared in full in constant time), handle Triggered and Cleared alerts |
| AWS SNS | aws-sns-webhooks |
Verify AWS SNS message signatures (RSA with SigningCertURL), confirm subscriptions, handle Notification envelopes |
| Axilio | axilio-webhooks |
Verify Axilio webhook signatures (webhook-id, webhook-timestamp, webhook-signature, Standard Webhooks HMAC-SHA256, whsec_ secret), handle run.completed, run.failed and session.ended events |
| Axiom | axiom-webhooks |
Authenticate Axiom Custom webhook notifier requests (unsigned: a secret header compared in full in constant time), handle monitor open and closed notifications |
| Ayrshare | ayrshare-webhooks |
Verify Ayrshare webhooks (x-authorization-content-sha256-v2: v1= hex HMAC-SHA256 of the raw body), handle scheduled post, social account, message and comment actions |
| Azure DevOps | azure-devops-webhooks |
Authenticate Azure DevOps Web Hooks service hooks (unsigned basic auth credentials compared in constant time), handle eventTypes like git.push, git.pullrequest.created and workitem.updated |
| Azure Event Grid | azure-event-grid-webhooks |
Receive Azure Event Grid deliveries, which carry no payload signature at all — trust comes from the ownership handshake (Microsoft.EventGrid.SubscriptionValidationEvent echoed as validationResponse with HTTP 200, or the CloudEvents v1.0 OPTIONS abuse-protection preflight) plus channel auth via a static delivery-property header, a query-parameter client secret, or a Microsoft Entra ID bearer token; guard on aeg-subscription-name and parse Event Grid arrays vs CloudEvents objects |
| Azure Logic Apps | azure-logic-apps-webhooks |
Receive calls from a Logic Apps or Power Automate HTTP action, which are not signed: authenticate with Basic auth (Authorization: Basic base64(username:password)), Raw authentication or a shared-secret header using a constant-time compare; no event types, the payload is whatever the workflow sends |
| BambooHR | bamboohr-webhooks |
Verify BambooHR webhooks (X-BambooHR-Signature: hex HMAC-SHA256 of the body followed by X-BambooHR-Timestamp), handle employee created, updated and deleted actions |
| BaseLinker | baselinker-webhooks |
Receive BaseLinker (Base.com) order callbacks, which arrive as bodyless HTTP HEAD requests with the whole payload in the query string (observed: order_id, state) — there is no signature, secret, or handshake to verify, so respond with a bare bodyless 200 and fetch detail via getOrders (X-BLToken) |
| Baserow | baserow-webhooks |
Authenticate Baserow webhooks (unsigned: a secret header compared in full in constant time, any HTTP method), handle event_types like rows.created, rows.updated and rows.deleted |
| Baseten | baseten-webhooks |
Verify Baseten webhooks (X-BASETEN-SIGNATURE: v1= hex HMAC-SHA256 of the raw body), handle async inference results |
| Basin | basin-webhooks |
Verify Basin form-submission webhooks (X-Basin-Signature sha256=<hex>, HMAC-SHA256 of the raw body; Growth plan and above), handle JSON or form-encoded submissions |
| Basiq | basiq-webhooks |
Verify Basiq webhooks (Standard Webhooks: webhook-id, webhook-timestamp, webhook-signature, whsec_ secret), handle user.created, connection.activated, consent.revoked, account.updated and transactions.updated events |
| Bayou Energy | bayou-energy-webhooks |
Verify Bayou Energy webhooks (Standard Webhooks: webhook-id, webhook-timestamp, webhook-signature, whsec_ secret), handle new bill, updated bill, bills ready and intervals ready events |
| beehiiv | beehiiv-webhooks |
Verify beehiiv webhooks (delivered by Svix: svix-id, svix-timestamp, svix-signature, whsec_ secret), handle post, subscription and survey events |
| Belco | belco-webhooks |
Verify Belco webhooks (x-hook-signature: hex HMAC-SHA256 of the raw body), handle call and conversation events |
| Belvo | belvo-webhooks |
Authenticate Belvo webhooks (the whole Authorization value, Bearer or Basic, compared in constant time), handle Payments eventCodes and Aggregation webhook_codes |
| Better Stack | better-stack-webhooks |
Authenticate Better Stack Uptime webhooks (unsigned: HTTP Basic auth or a custom secret header, compared in constant time), handle incident, monitor and on-call change notifications |
| BigCommerce | bigcommerce-webhooks |
Verify BigCommerce webhook callbacks (Standard Webhooks or custom headers), handle store/order and product events with API fetch-back |
| BigMailer | bigmailer-webhooks |
Verify BigMailer webhooks (X-BigMailer-Signature: t=/v1= hex HMAC-SHA256 of {t}.{body}), handle bounce, click, complaint, open and unsubscribe events |
| Bindbee | bindbee-webhooks |
Verify Bindbee webhooks (Standard Webhooks: webhook-id, webhook-timestamp, webhook-signature, secret used as raw UTF-8 bytes), handle connector, hris, ats and lms events |
| Bird | bird-webhooks |
Verify Bird (formerly MessageBird) Standard Webhooks signatures (webhook-signature, HMAC-SHA256 base64 with a whsec_ secret), handle channel events like email.delivered, email.bounced and whatsapp.received |
| Bitbucket | bitbucket-webhooks |
Verify Bitbucket webhook signatures (X-Hub-Signature, HMAC-SHA256), handle repo push and pull request events |
| Bitculator | bitculator-webhooks |
Verify Bitculator webhooks (X-Bitculator-Signature: t=/v1= hex HMAC-SHA256 of {t}.{body}), handle alarm.triggered price alarm events |
| Bitdefender | bitdefender-webhooks |
Authenticate Bitdefender GravityZone Event Push Service deliveries (unsigned: the whole Authorization value compared in constant time), handle JSON-RPC addEvents batches by module like av, aph and avc |
| Bitrise | bitrise-webhooks |
Authenticate Bitrise outgoing webhooks (unsigned: a secret custom header compared in full in constant time), handle CI build events and Release Management events like app_version_added |
| Bland AI | bland-ai-webhooks |
Verify Bland AI webhook signatures (X-Webhook-Signature, HMAC-SHA256 hex of the body keyed with the account signing secret), handle post-call payloads with call_id, status and transcripts, plus citations and post_transfer_transcript events |
| BlindPay | blindpay-webhooks |
Verify BlindPay webhooks (delivered by Svix: svix-id, svix-timestamp, svix-signature, whsec_ secret), handle customer, payin, payout, transfer and wallet events |
| BoldSign | boldsign-webhooks |
Verify BoldSign webhook signatures (X-BoldSign-Signature t=<ts>, s0=<hex>, HMAC-SHA256 over {t}.{body}), handle e-signature events like Sent, Signed, Completed and Declined |
| Bolt | bolt-webhooks |
Verify Bolt checkout (boltapp.com) webhook signatures (X-Bolt-Hmac-Sha256, base64 HMAC-SHA256 of the raw body keyed with the Signing Secret), handle payment, auth, capture, credit, void, pending, and rejected_irreversible transaction events |
| Box | box-webhooks |
Verify Box V2 webhooks (BOX-SIGNATURE-PRIMARY: base64 HMAC-SHA256 of the body followed by BOX-DELIVERY-TIMESTAMP), handle file, folder, comment and collaboration triggers |
| Braze | braze-webhooks |
Authenticate Braze webhook campaigns and Canvas steps (unsigned Basic auth credential compared in constant time), handle the request bodies your messages compose |
| Breakcold | breakcold-webhooks |
Verify Breakcold webhooks (X-Webhook-Signature: sha256= hex HMAC-SHA256 of {X-Webhook-Timestamp}.{body}), handle record, note, task, relation, call and file events |
| Breezy HR | breezy-hr-webhooks |
Verify Breezy HR webhook signatures (X-Hook-Signature, HMAC-SHA256 hex of the raw body keyed with the whole whsec_ secret; not Standard Webhooks), handle events like candidateAdded and candidateStatusUpdated |
| Brevo | brevo-webhooks |
Authenticate Brevo (formerly Sendinblue) webhooks (unsigned: Basic auth in the notify URL or bearer token, plus IP allowlist), handle single or batched delivered, opened, click, hard_bounce, soft_bounce, spam, and unsubscribed events |
| Bridge | bridge-xyz-webhooks |
Verify Bridge (bridge.xyz) webhook signatures (X-Webhook-Signature, RSA-SHA256 with a per-endpoint public key), handle customer, kyc_link, transfer, and virtual_account events |
| Bridge API | bridge-api-webhooks |
Verify Bridge API (bridgeapi.io, open-banking by Bridge/Bankin') webhook signatures (BridgeApi-Signature, HMAC-SHA256 hex with v1= scheme), handle item, item.account, payment.transaction, and user.deleted events |
| Bringg | bringg-webhooks |
Authenticate Bringg webhooks (unsigned Static Headers auth, compared in full in constant time), handle webhook_type events like task_created, task_done and task_cancelled |
| Browserbase | browserbase-webhooks |
Verify Browserbase Standard Webhooks signatures (webhook-signature, HMAC-SHA256 base64 over {id}.{timestamp}.{body} with the whsec_ secret shown only on create/rotate), handle Functions invocation and build events (functions.invocations.completed, functions.invocations.failed, functions.builds.failed) |
| BugSmash | bugsmash-webhooks |
Verify BugSmash webhooks (X-BugSmash-Signature: hex HMAC-SHA256 of {X-Webhook-Timestamp}.{body} with the bgsmsh_ secret key), handle comment and status events |
| Builder.io | builder-io-webhooks |
Authenticate Builder.io webhooks (unsigned: a secret custom header compared in full in constant time), handle content operations like publish, unpublish and delete |
| Buildkite | buildkite-webhooks |
Verify Buildkite webhooks (X-Buildkite-Token plain-text token by default, or X-Buildkite-Signature HMAC-SHA256 hex over {timestamp}.{body} keyed with the token), handle ping, build.scheduled, build.running, build.failing, build.finished, job.started, job.finished, and agent.connected events |
| Bump.sh | bump-sh-webhooks |
Verify Bump.sh webhooks (x-bump-signature-256: sha256= hex HMAC-SHA256 of the raw body), handle API structure change events |
| Bunny Stream | bunny-stream-webhooks |
Verify Bunny Stream webhook signatures (X-BunnyStream-Signature, HMAC-SHA256 hex over the raw body, keyed on the library Read-Only API key), handle video encoding events by numeric Status (3 Finished, 5 Failed, 9 CaptionsGenerated, 10 TitleOrDescriptionGenerated) |
| Buttondown | buttondown-webhooks |
Verify Buttondown webhooks (x-buttondown-signature: sha256= hex HMAC-SHA256 of the raw body), handle subscriber, email and automation events |
| BVNK | bvnk-webhooks |
Verify BVNK webhooks (x-signature: base64 HMAC-SHA256 of the raw body), handle payment, customer and ledger events |
| Cal.com | cal-com-webhooks |
Verify Cal.com webhook signatures (x-cal-signature-256, HMAC-SHA256 hex over the raw body), handle BOOKING_CREATED, BOOKING_RESCHEDULED, BOOKING_CANCELLED, BOOKING_PAID, and MEETING_ENDED events |
| Calendly | calendly-webhooks |
Verify Calendly webhook signatures (Calendly-Webhook-Signature, HMAC-SHA256 with timestamp), handle invitee.created and invitee.canceled events |
| CallRail | callrail-webhooks |
Verify CallRail webhook signatures (Signature, base64 HMAC-SHA1 of the raw body with the company signing key), handle pre-call, post-call, call modified, text message sent/received, and form submission webhooks |
| camelAI | camel-ai-webhooks |
Verify camelAI webhooks (Standard Webhooks: webhook-id, webhook-timestamp, webhook-signature, whsec_ secret), handle run, input, voice session and billing events |
| Campfire | campfire-webhooks |
Verify Campfire webhooks (Campfire-Webhook-Signature-v1: hex HMAC-SHA256 of {timestamp}:{body}), handle invoice, bill, memo, journal entry and contract events |
| Canny | canny-webhooks |
Verify Canny webhooks (Standard Webhooks: webhook-id, webhook-timestamp, webhook-signature, whsec_ secret; legacy canny-* headers ignored), handle post, comment and vote events |
| Cartesia | cartesia-webhooks |
Authenticate Cartesia agent webhooks (x-webhook-secret header compared with your secret in constant time; payload is unsigned), handle call_started, call_completed and post_call_analysis events |
| Cashfree | cashfree-webhooks |
Verify Cashfree webhooks (x-webhook-signature: base64 HMAC-SHA256 of x-webhook-timestamp followed by the body), handle payment, refund, payout and verification events |
| Castle | castle-webhooks |
Verify Castle webhook signatures (X-Castle-Signature, base64 HMAC-SHA256 of the raw body keyed with your API secret), handle $policy.matched and $list_item.created/archived/unarchived events |
| Celcoin | celcoin-webhooks |
Authenticate Celcoin webhook notifications (HTTP Basic auth compared in constant time), handle Pix, transfer and onboarding events by entity |
| Celitech | celitech-webhooks |
Verify Celitech webhooks (delivered by Svix: svix-id, svix-timestamp, svix-signature, whsec_ secret), handle eSIM and consumption events |
| Census (Fivetran Activations) | census-webhooks |
Verify Census (Fivetran Activations) sync webhook signatures (X-Signature, base64 HMAC-SHA256 of the raw body), handle sync.completed, sync.failed and sync.alert.raised events |
| Cerebrum | cerebrum-webhooks |
Verify Cerebrum webhook signatures (delivered by Svix: svix-id, svix-timestamp, svix-signature, HMAC-SHA256, whsec_ secret), handle ORDER_STATUS_CHANGE, ORDER_SCORE_CHANGE, ORDER_DISPUTE_RESOLVED and VOUCHER_REDEEMED events |
| Certn | certn-webhooks |
Verify Certn webhook signatures (Certn-Signature t=<ts>, v1=<hex>, HMAC-SHA256 over {t}.{body}; opt-in signing), handle applicant report updates dispatched on report_status (IN_PROGRESS, COMPLETE) |
| Chameleon | chameleon-webhooks |
Verify Chameleon webhooks (X-Chameleon-Signature: hex HMAC-SHA256 of the raw body), handle tour, survey, embed, demo and HelpBar events |
| Chargebee | chargebee-webhooks |
Receive and verify Chargebee webhooks (Basic Auth), handle subscription billing events |
| Chargeblast | chargeblast-webhooks |
Verify Chargeblast webhook signatures (Svix: svix-id, svix-timestamp, svix-signature, HMAC-SHA256, whsec_ secret), read the event type from X-Event-Type, handle alert.created, alert.updated and deflection.created events |
| CharityStack | charitystack-webhooks |
Verify CharityStack webhooks (X-Webhook-Signature: sha256= hex HMAC-SHA256 of {X-Webhook-Timestamp}.{body}), handle donation, subscription, contact and form events |
| Chatim | chatim-webhooks |
Verify Chatim webhooks (X-Chatim-Signature: sha256= hex HMAC-SHA256 of {X-Chatim-Timestamp}.{body}), handle chat started, message, form, closed, assigned and handoff events |
| Check | check-hq-webhooks |
Verify Check (checkhq.com) payroll webhook signatures (Check-Signature, HMAC-SHA256 hex of the raw body keyed with the webhook config key), handle payroll, payment and employee events |
| Checkly | checkly-webhooks |
Verify Checkly alert webhook signatures (x-checkly-signature, HMAC-SHA256 hex of the rendered body), handle ALERT_FAILURE, ALERT_DEGRADED and ALERT_RECOVERY alerts |
| Checkout Page | checkout-page-webhooks |
Verify Checkout Page webhooks (x-webhook-signature: sha256= hex HMAC-SHA256 of the raw body), handle booking, payment, subscription and customer events |
| Checkout.com | checkout-com-webhooks |
Verify Checkout.com webhook signatures (Cko-Signature, HMAC-SHA256 hex over the raw body, plus the optional static Authorization key), handle payment_approved, payment_captured, payment_refunded, dispute_received, and fraud_reported events |
| Chili Piper | chili-piper-webhooks |
Verify Chili Piper webhooks (X-Chili-Signature: hex HMAC-SHA256 of {X-Chili-Timestamp}.{body}), handle meeting created, updated and deleted events |
| Cin7 Core | cin7-core-webhooks |
Authenticate Cin7 Core webhooks (unsigned: the Bearer or custom header compared in full in constant time), handle EventTypes like Sale/Created and Sale/OrderAuthorised |
| Circle | circle-webhooks |
Verify Circle CPN/Mint webhook signatures (X-Circle-Signature, ECDSA_SHA_256), handle payments, paymentIntents, transfers, and payouts notifications |
| Circleback | circleback-webhooks |
Verify Circleback automation webhook signatures (x-signature, HMAC-SHA256 hex of the raw body), handle meeting export payloads |
| CircleCI | circleci-webhooks |
Verify CircleCI outbound webhook signatures (circleci-signature, HMAC-SHA256 hex in a versioned v1= list over the raw body, no timestamp), handle workflow-completed and job-completed events — not Circle (circle.com), a different company |
| Cisco Meraki | meraki-webhooks |
Verify Meraki Dashboard webhook alerts via the body sharedSecret (no HMAC header), handle motion_alert, settings_changed, sensor_alert, and stopped_reporting events |
| Claude Managed Agents | claude-managed-agents-webhooks |
Verify Anthropic Claude Managed Agents webhook signatures (X-Webhook-Signature), handle session lifecycle and outcome evaluation events |
| Clemta | clemta-webhooks |
Verify Clemta webhook signatures (webhook-signature, Standard Webhooks HMAC-SHA256, whsec_ secret), handle company.created, company.incorporated, service_order.completed and requirement.created events |
| Clerk | clerk-webhooks |
Verify Clerk webhook signatures, handle user, session, and organization events |
| Clickatell | clickatell-webhooks |
Authenticate Clickatell One API callbacks (unsigned: a Custom Security Header you name, compared in constant time), handle message status and inbound message events |
| ClickHouse | clickhouse-webhooks |
Authenticate ClickStack (ClickHouse) Generic alert webhooks (unsigned: a secret header compared in full in constant time), handle alert payloads from your template |
| ClickPost | clickpost-webhooks |
Authenticate ClickPost shipment status webhooks (unsigned: the whole Authorization: Token <token> value compared in constant time), handle scans by clickpost_status_code |
| ClickUp | clickup-webhooks |
Verify ClickUp webhook signatures (X-Signature, HMAC-SHA256 hex over the raw body with the per-webhook webhook.secret), handle taskCreated, taskUpdated, taskStatusUpdated, and taskCommentPosted events |
| Clio | clio-webhooks |
Complete the Clio X-Hook-Secret handshake and verify X-Hook-Signature (HMAC-SHA256 hex), handle matter, contact, activity, and bill events |
| Cloudentity (SecureAuth) | cloudentity-webhooks |
Authenticate Cloudentity (SecureAuth) webhooks (unsigned: the X-API-Key webhook key compared in constant time), handle batched audit_events like user.created and user.authenticated |
| Cloudflare | cloudflare-webhooks |
Authenticate Cloudflare Notifications generic webhooks via the shared secret sent verbatim in the cf-webhook-auth header (no HMAC/signature; constant-time compare, reject if missing or different), handle alerts routed on alert_type such as advanced_ddos_attack_l7_alert, health_check_status_notification, dedicated_ssl_certificate_event_type, access_custom_certificate_expiration_type, workers_alert and the dashboard test message — not Cloudflare Workers |
| Cloudinary | cloudinary-webhooks |
Verify Cloudinary notifications via the x-cld-signature / x-cld-timestamp headers (hex digest of raw body + timestamp + account API Secret, sha1 default or sha256) using the official SDK, handle upload, eager, delete, rename, moderation, and resource_tags_changed events |
| CloudSignal (Cloudprinter.com) | cloudsignal-webhooks |
Authenticate CloudSignal (Cloudprinter.com) print-fulfilment webhooks via the plaintext per-endpoint Webhook API key in the JSON body's apikey field (no HMAC/signature header, timing-safe compared), handle CloudprinterOrderValidated, ItemValidated, ItemProduce, ItemProduced, ItemPacked, ItemShipped, ItemError, ItemCanceled, and CloudprinterOrderCanceled signals |
| Cloudsmith | cloudsmith-webhooks |
Verify Cloudsmith webhooks (X-Cloudsmith-Signature: hex HMAC-SHA1 of the raw body), handle package lifecycle and security scan events |
| CloudTalk | cloudtalk-webhooks |
Verify CloudTalk (Svix) webhook signatures (svix-id, svix-timestamp, svix-signature, HMAC-SHA256), handle call.started, call.answered, call.ended and contact.created events |
| Coassemble | coassemble-webhooks |
Verify Coassemble webhooks (X-Coassemble-Signature: sha256= hex HMAC-SHA256 of {X-Coassemble-Timestamp}.{body}), handle course, quiz and migration events |
| Codat | codat-webhooks |
Verify Codat webhooks (Svix-delivered Standard Webhooks, webhook-signature HMAC-SHA256 base64 with a whsec_ secret), handle events like company.created, connection.created and read.completed |
| Coinbase Commerce | coinbase-commerce-webhooks |
Verify Coinbase Commerce webhook signatures (X-CC-Webhook-Signature, HMAC-SHA256), handle charge lifecycle events |
| Column | column-webhooks |
Verify Column webhooks (Column-Signature: hex HMAC-SHA256 of the raw body), handle ach.outgoing_transfer.completed, ach.outgoing_transfer.returned and book.transfer.completed events |
| Commerce Layer | commercelayer-webhooks |
Verify Commerce Layer webhook signatures (X-CommerceLayer-Signature, HMAC-SHA256 base64), handle orders.place, orders.pay, and shipments.ship events |
| Community | community-webhooks |
Verify Community (community.com SMS platform) webhook signatures (community-signature, HMAC-SHA256 hex over {t}.{raw_body}), handle message.inbound, message.outbound, member.created, member.updated, and member.deleted events |
| CompanyCam | companycam-webhooks |
Verify CompanyCam webhook signatures (X-CompanyCam-Signature, base64 HMAC-SHA1 of the raw body keyed with the webhook token), handle photo.created and project.created events |
| ComplyCube | complycube-webhooks |
Verify ComplyCube webhooks (ComplyCube-Signature: hex HMAC-SHA256 of the raw body), handle check, client, document and workflow session events |
| ConfigCat | configcat-webhooks |
Verify ConfigCat webhooks (X-ConfigCat-Webhook-Signature-V1: base64 HMAC-SHA256 of webhook ID + timestamp + body, configcat_whsk_ key), handle setting-change notifications |
| Confluence Data Center | confluence-webhooks |
Verify Confluence Data Center webhook signatures (X-Hub-Signature: sha256=<hex>, HMAC-SHA256 of the raw body; not Confluence Cloud), handle events like page_created and page_updated |
| Connecteam | connecteam-webhooks |
Authenticate Connecteam webhooks (unsigned: the x-webhook-secret secretKey compared in constant time), handle user, form, time clock, scheduler and task events |
| Convex | convex-webhooks |
Verify Convex webhooks (x-webhook-signature: sha256= hex HMAC-SHA256 of the raw body), handle log stream events |
| Convox | convox-webhooks |
Verify Convox webhooks (Convox-Signature: t=/v1= hex HMAC-SHA256 of {t}.{body}), handle app, build, release and budget events |
| Copper | copper-webhooks |
Authenticate Copper CRM webhooks (unsigned: a secret in the subscription's headers, compared in full in constant time), handle new, update and delete events for people, leads, companies and opportunities |
| Coterie | coterie-webhooks |
Authenticate Coterie webhooks (the opt-in Authentication: token <guid> header compared in full in constant time), handle application, quote and policy payloads |
| Courier | courier-webhooks |
Verify Courier outbound webhook signatures (courier-signature, HMAC-SHA256 with timestamp), handle message:updated, notification:submitted, and audiences events |
| Cover Genius | cover-genius-webhooks |
Authenticate Cover Genius Offers webhooks (X-Api-Key compared with your key in constant time; XClaim and RentalCover schemes aren't covered), handle booking and renewal events like BOOKING_CREATED |
| Creem | creem-webhooks |
Verify Creem webhooks (creem-signature: hex HMAC-SHA256 of the raw body), handle checkout, subscription, refund and credit events |
| Cronofy | cronofy-webhooks |
Verify Cronofy push notifications (Cronofy-HMAC-SHA256, a comma-separated list of base64 HMAC-SHA256 digests over the raw body keyed with the app client secret, any match wins), handle verification, change, profile_disconnected, conferencing_profile_disconnected, profile_initial_sync_completed, and gdpr_requested notifications |
| Crossmint | crossmint-webhooks |
Verify Crossmint webhooks (delivered by Svix: svix-id, svix-timestamp, svix-signature, whsec_ secret), handle wallet, order, purchase and NFT events |
| Crusoe Cloud | crusoe-webhooks |
Verify Crusoe Cloud notification webhook signatures (delivered via Svix: svix-id/svix-timestamp/svix-signature, HMAC-SHA256 base64), handle resource.automated_remediation, resource health, budget alert, organization, and Managed AI notifications |
| CryptoProcessing | cryptoprocessing-webhooks |
Verify CryptoProcessing webhooks (X-Processing-Signature: hex HMAC-SHA512 of the raw body), handle deposit, withdrawal and exchange callbacks |
| Currents | currents-webhooks |
Authenticate Currents HTTP webhooks (unsigned: a secret custom header compared in full in constant time), handle RUN_START, RUN_FINISH, RUN_TIMEOUT and RUN_CANCELED |
| Cursor | cursor-webhooks |
Verify Cursor Cloud Agent webhook signatures, handle agent status events |
| Customer.io | customerio-webhooks |
Verify Customer.io reporting webhook signatures (X-CIO-Signature, v0 HMAC-SHA256 with timestamp), handle object_type + metric events |
| Cuuro | cuuro-webhooks |
Verify Cuuro webhook signatures (Svix: svix-id, svix-timestamp, svix-signature, HMAC-SHA256, whsec_ secret), handle startup.created, analysis.created and analysis.completed events |
| Cyberimpact | cyberimpact-webhooks |
Authenticate Cyberimpact scenario webhooks (unsigned: a secret header compared in full in constant time), handle automation.webhook.send contact payloads |
| Cyera | cyera-webhooks |
Verify Cyera Privacy webhooks (X-Webhook-Signature: base64 HMAC-SHA256 of {X-Webhook-Timestamp}:{body}), handle access, deletion, opt-out and health-check requests |
| Databricks | databricks-webhooks |
Authenticate Databricks webhook notification destinations (unsigned: HTTP Basic auth username/password, Authorization header), handle jobs.on_start, jobs.on_success, jobs.on_failure, jobs.on_duration_warning_threshold_exceeded, and SQL alert_state_change events |
| Datacake | datacake-webhooks |
Authenticate Datacake outgoing webhooks (unsigned: a header you add, compared in constant time), handle measurement, decoder and downlink events |
| DatoCMS | datocms-webhooks |
Authenticate DatoCMS webhooks (unsigned HTTP Basic auth compared in constant time), handle entity_type/event_type pairs like item publish and upload delete |
| Datto RMM | datto-rmm-webhooks |
Authenticate Datto RMM Global Webhooks (unsigned: a secret header compared in full in constant time), handle alert raised and resolved payloads from your template |
| Daytona | daytona-webhooks |
Verify Daytona sandbox webhooks (signed via Svix, which Daytona's docs don't state: svix-id/svix-timestamp/svix-signature, HMAC-SHA256 base64 over {id}.{timestamp}.{raw body}, whsec_ secret), dedupe on svix-id, handle sandbox.created, sandbox.state.updated, snapshot.created, snapshot.removed, volume.created and volume.state.updated events |
| dbt Cloud | dbt-cloud-webhooks |
Verify dbt Cloud webhooks (Authorization header carries the bare hex HMAC-SHA256 of the raw body, no prefix), handle job.run.started, job.run.completed and job.run.errored events |
| DealHub | dealhub-webhooks |
Authenticate DealHub webhooks (no signature: constant-time compare of the full Authorization value, Bearer <TOKEN> or Basic <CREDENTIALS>), handle draftQuote, primaryQuote, quoteWon, version, user and productsUpload events |
| Deck | deck-webhooks |
Verify Deck (deck.co) Standard Webhooks signatures with a caller-generated whsec_ secret, handle task run, credential, workflow run and interaction (MFA) events |
| Deepgram | deepgram-webhooks |
Receive and verify Deepgram transcription callbacks |
| Delivereasy | delivereasy-webhooks |
Verify Delivereasy webhooks (x-signature: base64 HMAC-SHA256 of the raw body), handle Lastmile booking updates |
| Deliverect | deliverect-webhooks |
Verify Deliverect webhooks (x-server-authorization-hmac-sha256: hex HMAC-SHA256 of the raw body), handle order status, menu, snooze and busy-mode calls |
| Demodesk | demodesk-webhooks |
Authenticate Demodesk webhooks (unsigned: a custom header compared in full in constant time), handle meta.event.actions like demo.scheduled, demo.ended and recording.uploaded |
| Dentally | dentally-webhooks |
Verify Dentally webhook signatures (X-Dentally-Signature, HMAC-SHA256 hex of the raw body), handle appointment, patient and payment events |
| Descope | descope-webhooks |
Verify Descope Audit Webhook connector signatures (x-descope-webhook-s256, HMAC-SHA256 base64 of the body), handle batched audit events like LoginSucceed, UserModified and Change Password |
| Didit | didit-webhooks |
Verify Didit identity verification webhook signatures (X-Signature, HMAC-SHA256 hex of the raw body keyed with the destination's secret_shared_key, plus X-Timestamp window), handle status.updated and data.updated events |
| Digital Samba | digital-samba-webhooks |
Authenticate Digital Samba webhooks (unsigned: Authorization: Bearer <secret> compared in constant time), handle participant_joined, session_ended and recording_ready events |
| Discord | discord-webhooks |
Verify Discord webhook event signatures (Ed25519), handle application and entitlement events |
| Docker Hub | docker-hub-webhooks |
Receive Docker Hub repository push webhooks, which are unsigned — no signature header, no shared secret, no HMAC, no timestamp, no auth option — so replace verification with a secret URL token (constant-time compare, fail closed), a repository.repo_name allowlist and a re-check via the Hub API GetRepositoryTag; parse push_data.tag / pusher / repository.repo_name, handle the dhi_metadata digest map on mirrored Docker Hardened Image repos, and ignore the legacy callback_url (there is no event type to switch on) |
| Documenso | documenso-webhooks |
Authenticate Documenso webhooks (unsigned: X-Documenso-Secret shared secret header compared in constant time, empty header rejected), handle events like DOCUMENT_SIGNED and DOCUMENT_COMPLETED |
| Document360 | document360-webhooks |
Authenticate Document360 notification webhooks (unsigned: a header compared in full in constant time, POST or PUT), handle Events like Article published |
| DocuSign | docusign-webhooks |
Verify DocuSign Connect signatures (X-DocuSign-Signature-N, HMAC-SHA256 base64), handle envelope and recipient events |
| Dodo Payments | dodo-payments-webhooks |
Verify Dodo Payments webhooks (Standard Webhooks: webhook-id, webhook-timestamp, webhook-signature, whsec_ secret), handle payment, refund, dispute and subscription events |
| Dojah | dojah-webhooks |
Verify Dojah webhook signatures (x-dojah-signature, HMAC-SHA256 hex of the raw body), handle kyc_widget verification_status results (Completed, Failed, Abandoned) |
| DoorDash Drive | doordash-drive-webhooks |
Authenticate DoorDash Drive webhooks (the whole Authorization value from the Developer Portal compared in constant time), handle event_names like DASHER_PICKED_UP and DASHER_DROPPED_OFF |
| Doppler | doppler-webhooks |
Verify Doppler webhook signatures (X-Doppler-Signature sha256=<hex>, HMAC-SHA256 of the raw body), handle config.secrets.update events when secrets change in a config |
| Dots | dots-webhooks |
Verify Dots webhooks (delivered by Svix: svix-id, svix-timestamp, svix-signature, whsec_ secret), handle payment, flow, dispute and payout events |
| Doubleword | doubleword-webhooks |
Verify Doubleword webhook signatures (webhook-id, webhook-timestamp, webhook-signature, HMAC-SHA256, whsec_ secret), handle batch.completed and batch.failed events |
| Drata | drata-webhooks |
Authenticate Drata workflow "Send webhook" deliveries (no documented signature: constant-time compare of a shared-secret custom header such as X-Webhook-Secret), handle CONTROL_EVIDENCE_LINKED, CONTROL_READINESS_CHANGED_TO_NOT_READY, CONTROL_TEST_CHANGED_TO_FAIL and other control event_type values |
| Dropbox | dropbox-webhooks |
Verify Dropbox API webhook signatures (X-Dropbox-Signature, HMAC-SHA256 hex), answer the challenge verification request, handle list_folder change notifications |
| Dub | dub-webhooks |
Verify Dub webhooks (Dub-Signature: hex HMAC-SHA256 of the raw body), handle link, lead, sale, partner and commission events |
| Duffel | duffel-webhooks |
Verify Duffel webhook signatures (X-Duffel-Signature t=<ts>,v1=<hex>, HMAC-SHA256 over {t}.{body}), handle travel events like order.created, order.airline_initiated_change_detected and ping.triggered |
| Dwolla | dwolla-webhooks |
Verify Dwolla webhook signatures (X-Request-Signature-SHA-256, HMAC-SHA256 hex), handle customer and transfer events |
| Dynatrace | dynatrace-webhooks |
Authenticate Dynatrace problem notification webhooks (unsigned: a secret header compared in full in constant time), handle OPEN and RESOLVED problems from your payload template |
| eBay | ebay-webhooks |
Complete the eBay endpoint challenge, verify the x-ebay-signature (ECDSA via getPublicKey), handle MARKETPLACE_ACCOUNT_DELETION notifications |
| Egnyte | egnyte-webhooks |
Authenticate Egnyte webhooks (unsigned: the whole Authorization value set as authHeader, compared in constant time), handle batched data[] file, folder, link and permission events |
| ElevenLabs | elevenlabs-webhooks |
Verify ElevenLabs webhook signatures, handle call transcription events |
| Emporix | emporix-webhooks |
Verify Emporix webhooks (Svix-delivered: svix-id, svix-timestamp, svix-signature, HMAC-SHA256 base64 with a whsec_ secret; the HTTP strategy isn't covered), handle commerce events like order.created and customer.created |
| Enode | enode-webhooks |
Verify Enode webhook signatures (x-enode-signature, HMAC-SHA1 hex over the raw body), handle EV and energy events like user:vehicle:updated, user:charger:updated, and user:battery:updated |
| Envoy | envoy-webhooks |
Verify Envoy webhook signatures (X-Envoy-Signature, base64 HMAC-SHA256 of the raw body keyed with your app's client secret), handle visitor events like entry_sign_in and invite_created |
| epilot | epilot-webhooks |
Verify epilot webhooks (Standard Webhooks: webhook-id, webhook-timestamp, webhook-signature, whsec_ secret), handle automation_trigger_webhook, customer_request_created and FileCreated events |
| Estuary | estuary-webhooks |
Authenticate Estuary materialization triggers and HTTP Webhook deliveries (unsigned: a header you configure, compared in constant time), accept POST, PUT or PATCH |
| Ethoca | ethoca-webhooks |
Receive Ethoca (Mastercard) Alerts Push API webhooks — no HMAC signature; authenticity is mutual TLS (MSSL, Entrust CA) plus HTTP Basic Auth — dispatch fraud and dispute alerts on alertType |
| Etsy | etsy-webhooks |
Verify Etsy Standard Webhooks signatures (webhook-signature, HMAC-SHA256 base64 over {webhook-id}.{webhook-timestamp}.{body} with a whsec_ secret), handle order.paid, order.shipped, order.canceled, listing.updated, and inventory.out_of_stock events |
| Exa | exa-webhooks |
Verify Exa Websets webhook signatures (Exa-Signature t=<ts>,v1=<hex>, HMAC-SHA256 over {t}.{body}), handle events like webset.created, webset.item.created and webset.idle |
| Exact Online | exact-online-webhooks |
Verify Exact Online HashCode body signatures (HMAC-SHA256 over the Content node, hex, uppercased), subscribe to topics, handle Accounts, Items, StockPositions, GoodsDeliveries events |
| Expo (EAS) | expo-webhooks |
Verify Expo EAS webhook signatures (expo-signature sha1=<hex>, HMAC-SHA1 of the raw body), handle EAS Build and Submit completion payloads with finished, errored and canceled statuses |
facebook-webhooks |
Verify Facebook Graph API webhook signatures (X-Hub-Signature-256, HMAC-SHA256), complete the hub.challenge handshake, handle Page and User field updates |
|
| Factorial | factorial-webhooks |
Authenticate Factorial webhooks (unsigned: the x-factorial-wh-challenge value compared in constant time), handle subscription types like employees/employee/create_with_contract and timeoff/leave/create |
| Fanvue | fanvue-webhooks |
Verify Fanvue creator-platform webhook signatures (X-Fanvue-Signature: t=<unix>,v0=<hex>, HMAC-SHA256 hex over <t>.<raw body>, with a bare second MAC during secret rotation that must also be accepted), answer the unsigned fanvue.webhook.verification probe, and handle the creator.*, checkout_link.*, payout.* and app.* event families plus the deprecated flat legacy events |
| FastSpring | fastspring-webhooks |
Verify FastSpring webhook signatures (X-FS-Signature, HMAC-SHA256 base64 over the raw body), iterate the batched events array, handle order.completed, subscription.activated, subscription.charge.completed, and subscription.canceled events |
| Fathom | fathom-webhooks |
Verify Fathom AI notetaker webhooks (Standard Webhooks: webhook-id / webhook-timestamp / webhook-signature, base64 HMAC-SHA256 over id.timestamp.body keyed with the decoded whsec_ secret) via the fathom-typescript / fathom-python SDKs, and handle the single "new meeting content ready" payload (summary, transcript, action items) |
| Faundit | faundit-webhooks |
Verify Faundit lost-and-found / returns webhook signatures (X-Faundit-Signature-Next, HMAC-SHA256 hex over v1:<timestamp>:<body> with the X-Faundit-Timestamp header; deprecated v0 X-Faundit-Signature signs v0:<timestamp> only), handle the item-status and request-status events whose granular status (delivered, finished, expired, registered, resolved, …) is the data.status field |
| Favro | favro-webhooks |
Verify Favro X-Favro-Webhook signatures (base64 HMAC-SHA1 over payloadId + the registered URL, NOT the body), accept the setup ping, handle card.created, card.committed, card.moved, card.updated, card.deleted, and comment.* events |
| Featurebase | featurebase-webhooks |
Verify Featurebase webhooks (X-Webhook-Signature: hex HMAC-SHA256 of {X-Webhook-Timestamp}.{body}, whsec_ secret used as-is), handle post, ticket, comment, changelog and conversation events |
| Felloh | felloh-webhooks |
Verify Felloh webhook signatures (X-Signature, hex HMAC-SHA256 of the raw body), handle transaction-status, refund-status and booking events |
| Fiber AI | fiber-ai-webhooks |
Verify Fiber AI webhooks (Svix: svix-id, svix-timestamp, svix-signature, whsec_ secret), handle async job events like reveal.completed |
| Fillout | fillout-webhooks |
Authenticate Fillout form submission webhooks (unsigned; constant-time compare of the custom Authorization: Bearer <token> header set in Advanced mode), parse the submission (submissionId, questions, calculations, urlParameters, scheduling) or an Advanced mode mapped body — Fillout has no event types, only form submissions |
| Fingerprint | fingerprint-webhooks |
Verify Fingerprint webhooks (FPJS-Event-Signature: v1= hex HMAC-SHA256 of the raw body), handle identification events |
| Fireberry | fireberry-webhooks |
Authenticate Fireberry webhook automations (unsigned: a secret header on the action compared in full in constant time), handle the record payloads your automation sends |
| Fireblocks | fireblocks-webhooks |
Verify Fireblocks webhook v2 signatures (detached JWS RS512 via JWKS), handle transaction lifecycle events |
| Firecrawl | firecrawl-webhooks |
Verify Firecrawl webhook signatures (X-Firecrawl-Signature sha256=<hex>, HMAC-SHA256 of the raw body keyed with the account secret), handle crawl, batch scrape and extract events like crawl.page and crawl.completed |
| Fireflies | fireflies-webhooks |
Verify Fireflies.ai Webhooks V2 signatures (X-Hub-Signature, sha256= + HMAC-SHA256 hex over the raw body), handle meeting.transcribed / meeting.summarized / meeting.bot_joined; legacy V1 documented |
| FireHydrant | firehydrant-webhooks |
Verify FireHydrant webhook signatures (fh-signature, HMAC-SHA256 hex of the raw body), handle incident, change_event and signals_alerts payloads |
| Firstbase | firstbase-webhooks |
Authenticate Firstbase webhooks (unsigned: a custom header compared in full in constant time), handle CREATED, UPDATED and DELETED notifications for orders and inventory |
| FirstPromoter | firstpromoter-webhooks |
Authenticate FirstPromoter Webhooks v2 (unsigned: a custom header you add, compared in constant time), handle promoter, referral, commission and payout events |
| Fivetran | fivetran-webhooks |
Verify Fivetran data pipeline webhook signatures (X-Fivetran-Signature-256, HMAC-SHA256 hex of the raw body keyed with the webhook secret, compared case-insensitively; signed only if a secret was set), handle sync_start, sync_end, connection_failure, transformation_succeeded events |
| Flagsmith | flagsmith-webhooks |
Verify Flagsmith webhook signatures (X-Flagsmith-Signature, HMAC-SHA256), handle FLAG_UPDATED, FLAG_DELETED and AUDIT_LOG_CREATED events |
| Flexport | flexport-webhooks |
Verify Flexport webhook signatures (X-Hub-Signature-256, HMAC-SHA256), handle freight milestone events like /shipment#created and /shipment_leg#departed |
| Flexprice | flexprice-webhooks |
Verify Flexprice webhook signatures (svix-id, svix-timestamp, svix-signature, HMAC-SHA256, whsec_ secret; Cloud only), handle invoice.update.finalized, payment.success and subscription.cancelled events |
| Flux CD | flux-cd-webhooks |
Verify Flux CD webhooks (X-Signature: sha256= hex HMAC-SHA256 of the raw body), handle Flux events (by severity and reason) |
| folk | folk-webhooks |
Verify folk (CRM) webhook signatures (webhook-id/webhook-timestamp/webhook-signature, Standard Webhooks HMAC-SHA256 base64 over {id}.{timestamp}.{raw body}, whsec_ secret shown once), handle person.created, person.updated, company.created and object.created events |
| Footprint | footprint-webhooks |
Verify Footprint webhook signatures (Svix: svix-id/svix-timestamp/svix-signature, HMAC-SHA256 base64, whsec_ secret), handle footprint.onboarding.completed, footprint.onboarding.status_changed and footprint.watchlist_check.completed events |
| Forgejo | forgejo-webhooks |
Verify Forgejo webhooks (X-Forgejo-Signature: hex HMAC-SHA256 of the raw body), handle push, issue, pull request and release events |
| Form.io | formio-webhooks |
Authenticate Form.io Webhook actions (unsigned HTTP Basic auth compared in constant time), handle submission create, update and delete requests (POST, PUT and DELETE) |
| Formbricks | formbricks-webhooks |
Verify Formbricks webhook signatures (webhook-id, webhook-timestamp, webhook-signature, Standard Webhooks HMAC-SHA256 with a whsec_ secret), handle responseCreated, responseUpdated and responseFinished events |
| Formspree | formspree-webhooks |
Verify Formspree webhooks (Formspree-Signature: t=/v1= hex HMAC-SHA256 of {t}.{body}), handle form submissions |
| Formstack | formstack-webhooks |
Verify Formstack Forms WebHook submit action signatures (X-FS-Signature, HMAC-SHA256 lowercase hex over the raw body, optional sha256= prefix, user-overridable header name), handle urlencoded and JSON submission payloads, and route on FormID — Formstack has no event types, only form submissions |
| Fountain | fountain-webhooks |
Verify Fountain webhooks (X-OBIQ-SIGNATURE-V2: hex HMAC-SHA256 of the raw body), handle applicant screening and Post-Hire worker events |
| FourKites | fourkites-webhooks |
Authenticate FourKites callbacks (unsigned HTTP Basic auth compared in constant time), handle MessageTypes like LOAD_CREATION, STOP_ARRIVAL and TRACKING_UPDATE |
| Foursquare | foursquare-webhooks |
Authenticate Foursquare Movement SDK webhooks (Pilgrim-Secret header compared in constant time), handle placeArrival, placeDeparture and geofenceEnter events |
| Fourthwall | fourthwall-webhooks |
Verify Fourthwall shop webhook signatures (X-Fourthwall-Hmac-SHA256, HMAC-SHA256 base64 of the raw body), handle events like ORDER_PLACED, ORDER_UPDATED, DONATION and SUBSCRIPTION_PURCHASED |
| Freemius | freemius-webhooks |
Verify Freemius webhooks (x-signature: hex HMAC-SHA256 of the raw body), handle license, subscription, payment and user events |
| Freshdesk | freshdesk-webhooks |
Receive Freshdesk automation-rule webhooks (Trigger Webhook action; unsigned), authenticate them with a shared-secret custom header compared in constant time, handle ticket_created and ticket_updated payloads |
| Freshsales | freshsales-webhooks |
Authenticate Freshsales workflow webhooks (unsigned: a secret custom header compared in full in constant time), handle the deal and contact payloads your workflow sends |
| Front | frontapp-webhooks |
Verify Front application webhook signatures (X-Front-Signature, HMAC-SHA256 over timestamp + body), complete the X-Front-Challenge handshake, handle inbound, outbound, move, assign, and tag events |
| FullEnrich | fullenrich-webhooks |
Verify FullEnrich webhook signatures (X-Signature-SHA1, HMAC-SHA1 keyed with your API key), handle FINISHED, IN_PROGRESS, CANCELED and CREDITS_INSUFFICIENT enrichment results |
| FusionAuth | fusionauth-webhooks |
Verify FusionAuth JWT webhook signatures, handle user, login, and registration events |
| GC Notify | gc-notify-webhooks |
Authenticate GC Notify delivery receipt callbacks (unsigned: the whole Authorization: Bearer <token> value compared in constant time), handle delivered, permanent-failure and technical-failure statuses for email and SMS |
| General Translation | general-translation-webhooks |
Verify General Translation webhooks (Standard Webhooks: webhook-id, webhook-timestamp, webhook-signature, whsec_ secret), handle translated file and translation job events |
| GitBook | gitbook-webhooks |
Verify GitBook webhooks (X-GitBook-Signature: t=/v1= hex HMAC-SHA256 of {t}.{body}), handle content update, page feedback and site view events |
| Gitea | gitea-webhooks |
Verify Gitea webhook signatures (X-Gitea-Signature, HMAC-SHA256 hex of the JSON payload), handle X-Gitea-Event events like push, pull_request, issues and release |
| GitHub | github-webhooks |
Verify GitHub webhook signatures, handle push, pull_request, and issue events |
| GitLab | gitlab-webhooks |
Verify GitLab signing-token signatures (Standard Webhooks HMAC-SHA256) or legacy X-Gitlab-Token, handle push, merge_request, issue, and pipeline events |
| Glean | glean-webhooks |
Verify Glean trigger webhooks (webhook-id, webhook-timestamp, webhook-signature, HMAC-SHA256, whsec_ secret), handle CONTENT_SCHEDULE trigger deliveries |
| GlobalStack | globalstack-webhooks |
Verify GlobalStack webhook signatures (svix-id, svix-timestamp, svix-signature, HMAC-SHA256, whsec_ secret), handle onramp.success, conversion.success, transfer.success and deposit.confirmed events |
| Go1 | go1-webhooks |
Verify Go1 webhook signatures (Go1-Signature t=<ms>,v1=<hex>, HMAC-SHA256 over {t}.{body} keyed with the webhook secret_key), handle learning events like enrollment.create and enrollment.update |
| GoCardless | gocardless-webhooks |
Verify GoCardless webhook signatures (Webhook-Signature, HMAC-SHA256), handle batched payment, mandate, and payout events |
| Goody | goody-webhooks |
Verify Goody webhook signatures (delivered by Svix: svix-id, svix-timestamp, svix-signature, HMAC-SHA256, whsec_ secret), handle order.created, order.gift_accepted, order.shipped and order_batch.completed events |
| Google Cloud Pub/Sub | google-pubsub-webhooks |
Verify Google Cloud Pub/Sub push subscriptions — there is no signing secret or HMAC header; validate the Google-signed OIDC Authorization: Bearer JWT (iss, aud, email, email_verified), parse the message.data / attributes envelope, and ack within the deadline |
| Google Gemini | gemini-webhooks |
Verify Gemini API webhook signatures (Standard Webhooks HMAC + JWKS modes), handle batch and long-running operation events |
| Google Workspace | google-workspace-webhooks |
Verify Google Drive, Calendar, and Admin SDK push notifications (X-Goog-Channel-Token channel token), handle X-Goog-Resource-State changes, and renew expiring watch channels |
| Gopuff | gopuff-webhooks |
Verify Powered by Gopuff partner webhooks (Svix-signed: svix-id, svix-timestamp, svix-signature, HMAC-SHA256 over id.timestamp.body with the base64-decoded whsec_ secret), handle order.status.v2, order.status and order.delivered, plus delivery status and ETA payloads (no event-type field in the body) |
| Gorgias | gorgias-webhooks |
Authenticate Gorgias HTTP integration requests (shared-secret Authorization: Bearer header, NO signature), handle ticket triggers like ticket-created, ticket-updated and ticket-message-created via an event field in the user-defined body template |
| GOV.UK Notify | govuk-notify-webhooks |
Authenticate GOV.UK Notify callbacks (unsigned: Authorization: Bearer <token> compared in constant time), handle delivery receipts, received text messages and returned letters |
| GOV.UK Pay | govuk-pay-webhooks |
Verify GOV.UK Pay webhooks (Pay-Signature: hex HMAC-SHA256 of the raw body), handle card payment events |
| Grafana | grafana-webhooks |
Verify Grafana Alerting webhook contact point signatures (HMAC-SHA256 lowercase hex, bare digest in the configurable X-Grafana-Alerting-Signature header, optionally over timestamp + ":" + body), dispatch on firing/resolved group status — there are no event types and no delivery id |
| Granola | granola-webhooks |
Verify Granola Standard Webhooks signatures (webhook-signature, HMAC-SHA256 base64 with a whsec_ secret), handle meeting note events like note.generated and note.edited |
| Gravity Forms | gravity-forms-webhooks |
Authenticate Gravity Forms Webhooks Add-On requests (unsigned; constant-time compare of a custom X-Webhook-Secret Request Header set on the feed), parse the form entry (field IDs like 1 and 3.3, id, form_id) sent as JSON or urlencoded form data — Gravity Forms has no event types, only form submissions |
| Green Dot | greendot-webhooks |
Authenticate Green Dot Embedded Finance (BaaS) webhook deliveries via the OAuth client_credentials Bearer token (scope post:webhook), verify the optional x-gd-signature header, echo x-GD-RequestId and return the responseDetails acknowledgement, handle transaction, accountUpdated, achTransfer, cardUpdate, billPayTransfer, directDepositSwitch, and provisioning events |
| GREEN-API | green-api-webhooks |
Authenticate GREEN-API (WhatsApp API gateway) Webhook Endpoint notifications — no HMAC; compare the full Authorization header (Bearer <token> or Basic <token> from webhookUrlToken) in constant time, dispatch on typeWebhook (incomingMessageReceived, outgoingMessageStatus, outgoingAPIMessageReceived, stateInstanceChanged) |
| Greenshades | greenshades-webhooks |
Verify Greenshades webhooks (X-GS-SIGNATURE: hex HMAC-SHA256 of X-GS-TIMESTAMP, a newline, then the body), handle pay run, pay schedule and employee events |
| Grist | grist-webhooks |
Authenticate Grist document webhooks (unsigned: the whole Authorization value compared in constant time), handle batched arrays of added and updated rows |
| Guesty | guesty-webhooks |
Verify Guesty webhook signatures (delivered by Svix: svix-signature, HMAC-SHA256 over id.timestamp.body), handle reservation.created.v2, reservation.updated.v2, legacy reservation.new/reservation.updated, and listing.* events |
| Gumlet | gumlet-webhooks |
Authenticate Gumlet webhooks (unsigned: the optional x-gumlet-token Secret Token compared in constant time), handle video, live stream and embed events |
| HackerOne | hackerone-webhooks |
Verify HackerOne webhook signatures (X-H1-Signature, sha256= hex HMAC-SHA256 of the raw body), handle report_created, report_triaged and report_bounty_awarded events |
| Hail | hail-webhooks |
Verify Hail webhook signatures (X-Hail-Signature t=<ts>,v1=<hex>, HMAC-SHA256 over {t}.{body}, whole whsec_ secret as the key), handle email.received, email.bounced, sms.received, and call.completed events |
| HaloPSA | halo-psa-webhooks |
Authenticate HaloPSA webhooks (unsigned: Authorization: Basic username and password compared in constant time), handle New Ticket Logged, Ticket Updated and Ticket Reassigned events |
| Harbor | harbor-webhooks |
Authenticate Harbor registry webhooks (unsigned: the Auth Header sent verbatim as Authorization, compared in constant time), handle artifact push, pull, scan and quota events |
| Hasura | hasura-webhooks |
Authenticate Hasura Event Trigger webhooks (unsigned: a secret header you add to the trigger, compared in full in constant time), handle INSERT, UPDATE, DELETE and MANUAL operations |
| HCP Terraform | terraform-webhooks |
Verify HCP Terraform / Terraform Enterprise notification signatures (X-TFE-Notification-Signature, HMAC-SHA512 hex of the raw body keyed with the notification token), handle run triggers like run:completed, run:errored and run:needs_attention |
| Helcim | helcim-webhooks |
Verify Helcim webhook signatures (webhook-id, webhook-timestamp, webhook-signature, HMAC-SHA256 with the base64 verifierToken), handle cardTransaction and terminalCancel events |
| Helius | helius-webhooks |
Authenticate Helius Solana webhooks (no signature: the authHeader you set is echoed verbatim in the Authorization header, compared in constant time), handle the batched transaction array and enhanced events like NFT_SALE, SWAP, and TRANSFER |
| Help Scout | help-scout-webhooks |
Verify Help Scout webhook signatures (X-HelpScout-Signature, HMAC-SHA1 base64 of the raw body), handle X-HelpScout-Event events like convo.created, convo.assigned and customer.created |
| Heroku | heroku-webhooks |
Verify Heroku app webhook signatures (Heroku-Webhook-Hmac-SHA256, HMAC-SHA256 base64 over the raw body), handle api:release, api:build, api:app, api:dyno, api:formation and api:addon-attachment events (create / update / destroy) |
| Hexclave | hexclave-webhooks |
Verify Hexclave webhook signatures (delivered by Svix: svix-id, svix-timestamp, svix-signature, HMAC-SHA256, whsec_ secret), handle user.created, user.updated and team.created events |
| HeyGen | heygen-webhooks |
Verify HeyGen webhook signatures (signature header, HMAC-SHA256 hex of the raw body keyed with the whole whsec_ secret; not Standard Webhooks), handle avatar_video.success and avatar_video.fail events |
| HiBob | hibob-webhooks |
Verify HiBob (Bob) Bob-Signature (base64 HMAC-SHA512 of the raw body), answer the Ping test, handle employee and time off events |
| HIFI | hifi-webhooks |
Verify HIFI webhooks (hifi-signature: t=/v1= hex HMAC-SHA256 of {t}.{body}), handle user, compliance, onramp, offramp and transfer events |
| High Mobility | high-mobility-webhooks |
Verify High Mobility webhooks (x-hm-signature-256: sha256= hex HMAC-SHA256 of the raw body), handle fleet clearance changes and ping deliveries |
| Hightouch | hightouch-webhooks |
Authenticate Hightouch HTTP Request destination calls (unsigned: a secret header compared in full in constant time), handle row added, changed and removed sync requests |
| Hint Health | hint-health-webhooks |
Verify Hint Health webhooks (x-hint-signature: sha256= hex HMAC-SHA256 of the raw body), handle patient, membership and practitioner events |
| HireHive | hirehive-webhooks |
Verify HireHive webhooks (Standard Webhooks: webhook-id, webhook-timestamp, webhook-signature, whsec_ secret), handle job, application and candidate events |
| HitPay | hitpay-webhooks |
Verify HitPay event webhook signatures (Hitpay-Signature, HMAC-SHA256 hex of the raw body keyed with the webhook salt), handle charge.created and order.created events |
| Holded | holded-webhooks |
Verify Holded webhook signatures (x-holded-webhook-signature sha256=<hex>, HMAC-SHA256 of the raw body keyed with the whole whsec_ secret; not Standard Webhooks), handle invoice.create and contact.create events |
| Honeybadger | honeybadger-webhooks |
Authenticate Honeybadger webhooks (Honeybadger-Token header compared with the project token in constant time), handle error and uptime events like occurred, resolved and down |
| Honeycomb | honeycomb-webhooks |
Authenticate Honeycomb trigger, SLO burn alert and anomaly webhooks (unsigned: the X-Honeycomb-Webhook-Token Shared Secret compared in constant time) |
| Hostaway | hostaway-webhooks |
Authenticate Hostaway webhooks (HTTP Basic auth from the webhook's login and password, compared in constant time), handle reservation, message and task events |
| HubSpot | hubspot-webhooks |
Verify HubSpot v3 webhook signatures (HMAC-SHA256 with timestamp), handle contact, deal, and company events |
| Hugging Face | huggingface-webhooks |
Authenticate Hugging Face webhooks (X-Webhook-Secret), handle repo, discussion, and comment events |
| Humaans | humaans-webhooks |
Verify Humaans webhooks (Standard Webhooks via Svix: webhook-id, webhook-timestamp, webhook-signature, whsec_ secret), handle person and time-away events |
| Hume | hume-webhooks |
Verify Hume EVI webhooks (X-Hume-AI-Webhook-Signature: hex HMAC-SHA256 of {body}.{timestamp}), handle chat_started, chat_ended and tool_call events |
| Huntress | huntress-webhooks |
Verify Huntress webhooks (Svix: svix-id, svix-timestamp, svix-signature, whsec_ secret), handle incident report and escalation notifications |
| Hyperswitch | hyperswitch-webhooks |
Verify Hyperswitch webhooks (X-Webhook-Signature-512: hex HMAC-SHA512 of the raw body), handle payment, refund, dispute, mandate and payout events |
| iDenfy | idenfy-webhooks |
Verify iDenfy webhooks (Idenfy-Signature: hex HMAC-SHA256 of the raw body), handle KYC, KYB and AML results |
| incident.io | incident-io-webhooks |
Verify incident.io webhooks (Standard Webhooks: webhook-id, webhook-timestamp, webhook-signature, HMAC-SHA256 base64), read the resource from body[event_type], handle public_incident.incident_created_v2, id-only private_* events and schedule.shift_change_v1 |
| Incode | incode-webhooks |
Authenticate Incode webhooks (unsigned: a custom header from the dashboard, compared in constant time), answer 200 JSON, handle session and onboarding events |
| Increase | increase-webhooks |
Verify Increase webhooks (Standard Webhooks headers, HMAC-SHA256 base64 over {id}.{timestamp}.{body} keyed with the raw shared_secret, not whsec_), handle event categories like transaction.created |
| Infinite Giving | infinite-giving-webhooks |
Verify Infinite Giving webhook signatures (X-IG-Signature, HMAC-SHA256 of {X-IG-Timestamp}.{body}), handle donation:created and donation:updated events |
| INGENIOUS.BUILD | ingenious-build-webhooks |
Authenticate INGENIOUS.BUILD Custom Accounting Integration webhooks (unsigned: a header you name, its whole value compared in constant time), handle budget, contract and invoice exports |
| Instantly | instantly-webhooks |
Authenticate Instantly cold email webhooks — no signature; constant-time compare of the custom header you attach to the webhook (Authorization: Basic ... or a secret header), handle email_sent, reply_received, email_bounced, lead_interested, lead status and custom label events |
| Intercom | intercom-webhooks |
Verify Intercom X-Hub-Signature (HMAC-SHA1), handle conversation, contact, and ticket events |
| Invoice Ninja | invoice-ninja-webhooks |
Authenticate Invoice Ninja webhooks (unsigned: a secret header compared in full in constant time), handle invoice, payment and client entity payloads (and avoid the 404/405/410 responses that delete the subscription) |
| iSnap | isnap-webhooks |
Verify iSnap webhooks (Standard Webhooks: webhook-id, webhook-timestamp, webhook-signature, whsec_ secret), handle message.received, message.delivered and line.offline events |
| Iterable | iterable-webhooks |
Authenticate Iterable system webhooks (the whole Authorization value, Bearer or Basic, compared in constant time), handle eventNames like emailSend, emailOpen and emailBounce |
| Jamf Pro | jamf-pro-webhooks |
Authenticate Jamf Pro webhooks (unsigned: a Header Authentication header compared in full in constant time), handle webhookEvents like ComputerAdded and MobileDeviceEnrolled |
| Jamie | jamie-webhooks |
Verify Jamie webhook signatures (x-jamie-signature t=<ts>,v0=<hex>, HMAC-SHA256 over {t}.{body}), handle meeting.completed |
| JazzHR | jazzhr-webhooks |
Verify JazzHR candidate-export webhook signatures (X-JazzHR-Signature, HMAC-SHA256 hex of the raw body), handle CANDIDATE-EXPORT and the VERIFY setup event |
| JFrog | jfrog-webhooks |
Authenticate JFrog webhooks (token mode: X-JFrog-Event-Auth compared with the secret token in constant time; the signing mode is not covered), handle domain events like artifact deployed and docker pushed |
| Jira | jira-webhooks |
Verify Jira webhook signatures (X-Hub-Signature, HMAC-SHA256), handle issue and comment events |
| JobAdder | jobadder-webhooks |
Authenticate JobAdder webhooks (unsigned: the whole Authorization value compared in constant time), handle events like candidate_status_changed and placement_approved |
| Jobber | jobber-webhooks |
Verify Jobber app webhook signatures (X-Jobber-Hmac-SHA256, base64 HMAC-SHA256 of the raw body keyed with the OAuth client secret), handle topics like CLIENT_CREATE and INVOICE_UPDATE |
| JumpCloud | jumpcloud-webhooks |
Authenticate JumpCloud webhook channel notifications (unsigned HTTP Basic auth compared in constant time), handle alert notifications |
| Junction | junction-webhooks |
Verify Junction webhook signatures (svix-id, svix-timestamp, svix-signature, HMAC-SHA256, delivered by Svix), handle provider.connection.created, daily.data.sleep.created and historical.data.workouts.created events |
| Justt | justt-webhooks |
Verify Justt webhooks (Standard Webhooks: webhook-id, webhook-timestamp, webhook-signature, whsec_ secret), handle chargeback, pre-chargeback alert and subscription events |
| Katana MRP | katana-webhooks |
Verify Katana MRP webhooks (x-sha2-signature: hex HMAC-SHA256 of the raw body), handle sales, purchase and manufacturing order events |
| Khipu | khipu-webhooks |
Verify Khipu webhooks (x-khipu-signature: t=/s= base64 HMAC-SHA256 of {t}.{body}), handle payment reconciliation notifications |
| Kibana | kibana-webhooks |
Authenticate Kibana Webhook connector requests (HTTP Basic auth compared in constant time), accept the configured method, handle rule action templates |
| Kit (ConvertKit) | kit-webhooks |
Verify Kit (ConvertKit) webhook signatures (X-Kit-Signature t=<ts>,v1=<hex>, HMAC-SHA256 over {t}.{body} keyed with the whole whsec_ secret; not Standard Webhooks), handle subscriber.created, subscriber.activated, subscriber.unsubscribed and subscriber.tag_added events |
| Klaviyo | klaviyo-webhooks |
Verify Klaviyo webhook signatures (HMAC-SHA256), handle flow-triggered webhook events |
| Knock | knock-webhooks |
Verify Knock outbound webhook signatures (HMAC-SHA256 base64, millisecond timestamps), handle message lifecycle and resource change events |
| KnowBe4 | knowbe4-webhooks |
Authenticate KnowBe4 KSAT and PhishER webhooks (unsigned: a custom header you name, its whole value compared in constant time), handle phishing, training and PhishER message payloads |
| KoBoToolbox | kobotoolbox-webhooks |
Authenticate KoBoToolbox REST Service deliveries (unsigned HTTP Basic auth compared in constant time), handle new form submissions |
| Kombo | kombo-webhooks |
Verify Kombo webhook signatures (X-Kombo-Signature, unpadded base64url HMAC-SHA256 of the raw body), handle data-changed, integration-created and integration-state-changed events |
| KOMOJU | komoju-webhooks |
Verify KOMOJU webhooks (X-Komoju-Signature: hex HMAC-SHA256 of the raw body), handle payment, customer and subscription events |
| Kustomer | kustomer-webhooks |
Verify Kustomer outbound webhook signatures (X-Kustomer-Webhook-Signature, HMAC-SHA256 hex of the raw body), handle events like kustomer.conversation.create and kustomer.customer.update |
| Lago | lago-webhooks |
Verify Lago webhook signatures in HMAC mode (X-Lago-Signature, HMAC-SHA256 base64 of the raw body; the default JWT mode is not covered), handle billing events like invoice.created and subscription.terminated |
| Langfuse | langfuse-webhooks |
Verify Langfuse webhooks (x-langfuse-signature: t=/v1= hex HMAC-SHA256 of {t}.{body}), handle prompt version created, updated and deleted events |
| Laso Finance | laso-finance-webhooks |
Verify Laso Finance webhooks (Standard Webhooks: webhook-id, webhook-timestamp, webhook-signature, whsec_ secret), handle account, transaction, deposit, card and gift card notifications |
| LaunchDarkly | launchdarkly-webhooks |
Verify LaunchDarkly webhook signatures (HMAC-SHA256 hex over raw body, X-LD-Signature, optional so set a secret), handle flag, segment, project, and environment audit log events |
| Layerswap | layerswap-webhooks |
Verify Layerswap webhook signatures (svix-id, svix-timestamp, svix-signature, HMAC-SHA256, whsec_ secret), handle swap status updates (ls_transfer_pending, completed, failed, pending_refund, refunded) |
| LearnHouse | learnhouse-webhooks |
Verify LearnHouse webhooks (X-Webhook-Signature: sha256= hex HMAC-SHA256 of the raw body), handle course, activity, assignment and user events |
| LearnUpon | learnupon-webhooks |
Verify LearnUpon webhooks (X-Webhook-Signature: hex HMAC-SHA256 of the raw body), handle user, course, enrollment and learning path events |
| Lemon Squeezy | lemon-squeezy-webhooks |
Verify Lemon Squeezy webhook signatures (X-Signature, hex HMAC-SHA256 of the raw body, keyed with the signing secret you set), handle order_created, subscription_created, subscription_payment_success, and license_key_created events routed on X-Event-Name |
| Leonardo.Ai | leonardo-ai-webhooks |
Authenticate Leonardo.Ai webhook callbacks (unsigned: the whole Authorization: Bearer <key> value compared in constant time), handle image_generation.complete |
| Lessonly | lessonly-webhooks |
Authenticate Lessonly (Seismic Learning) lesson-completed callbacks (unsigned: the whole Authorization value compared in constant time) |
| Lettermint | lettermint-webhooks |
Verify Lettermint webhooks (X-Lettermint-Signature: t=/v1= hex HMAC-SHA256 of {t}.{body}), handle message.delivered, message.hard_bounced, message.spam_complaint and suppression.added events |
| LINE | line-webhooks |
Verify LINE Messaging API webhook signatures (x-line-signature, base64 HMAC-SHA256 of the raw body keyed on the channel secret) with the official SDK, answer the console Verify request (empty events), handle message, follow, unfollow, postback, join, memberJoined, and unsend events |
| Linear | linear-webhooks |
Verify Linear webhook signatures (HMAC-SHA256), handle issue, comment, and project events |
linkedin-webhooks |
Verify LinkedIn webhook signatures (X-LI-Signature, HMAC-SHA256) and the challengeCode validation, handle Lead Sync and organization events |
|
| Linq | linq-webhooks |
Verify Linq webhooks (Standard Webhooks: webhook-id, webhook-timestamp, webhook-signature, whsec_ secret, HMAC-SHA256), handle message.received, message.sent, message.delivered and reaction.added events |
| Lithic | lithic-webhooks |
Verify Lithic webhooks (Standard Webhooks / Svix, webhook-signature HMAC-SHA256) with the official SDK, handle card, transaction, payment, and dispute events |
| Live Tennis API | live-tennis-api-webhooks |
Verify Live Tennis API webhook signatures (X-LTAPI-Signature sha256=<hex>, HMAC-SHA256 of the raw body), handle score and point frames by X-LTAPI-Event |
| Liveblocks | liveblocks-webhooks |
Verify Liveblocks webhooks (Standard Webhooks: webhook-id, webhook-timestamp, webhook-signature, whsec_ secret), handle room, storage, Yjs, comment and thread events |
| Lob | lob-webhooks |
Verify Lob webhooks (Lob-Signature: hex HMAC-SHA256 of {Lob-Signature-Timestamp}.{body}), handle postcard, letter, check, self mailer and address events |
| Lodgix | lodgix-webhooks |
Verify Lodgix webhooks (X-Lodgix-Signature: sha256= hex HMAC-SHA256 of {X-Lodgix-Timestamp}.{body}), handle message.received events |
| Logto | logto-webhooks |
Verify Logto webhook signatures (logto-signature-sha-256, hex HMAC-SHA256 of the raw body), handle PostSignIn, PostRegister and User.Created events |
| Lokalise | lokalise-webhooks |
Authenticate Lokalise webhooks (X-Secret header compared with the webhook secret in constant time), handle events like project.translation.updated and project.keys.added |
| Loop | loop-webhooks |
Verify Loop (loop.com, freight audit and logistics payments) webhooks delivered by Svix (svix-id/svix-timestamp/svix-signature, HMAC-SHA256 base64 over {id}.{timestamp}.{raw-body} with the whsec_ secret), deduplicate on the payload eventId rather than svix-id, and handle flat eventType payloads such as payment.completed, receivable-invoice.finalized, shipment-job.rerated and business-exception.created. Not Loop Returns or Loop Subscriptions |
| Loop Returns | loop-returns-webhooks |
Verify Loop Returns webhook signatures (X-Loop-Signature, HMAC-SHA256 base64 of the raw body), handle return.created, return.updated, return.closed and label.created events |
| LoyaltyLion | loyaltylion-webhooks |
Verify LoyaltyLion webhooks (x-loyaltylion-hmac-sha256: base64 HMAC-SHA256 of the raw body), handle customer, program event and reward topics |
| Luma | luma-webhooks |
Verify Luma webhook signatures (Webhook-Signature t=<ts>,v1=<hex>, HMAC-SHA256 over {t}.{body} keyed with the whole whsec_ secret; not Standard Webhooks), handle guest.registered, ticket.registered, event.created and calendar.person.unsubscribed events |
| Lumos | lumos-webhooks |
Authenticate Lumos provisioning and deprovisioning webhooks with a custom header you name (whole value compared in constant time; the X-Lumos-Webhook-Signature HMAC is not verified) |
| Magic Hour | magic-hour-webhooks |
Verify Magic Hour webhooks (magic-hour-event-signature: hex HMAC-SHA256 of {timestamp}.{body}, whsec_ secret used as-is), handle video, image and audio job events |
| Mailchimp | mailchimp-webhooks |
Authenticate Mailchimp webhooks (URL secret + GET validation), handle subscribe, unsubscribe, and profile events |
| Mailcoach | mailcoach-webhooks |
Verify Mailcoach webhooks (Signature: hex HMAC-SHA256 of the raw body), handle subscriber and campaign events |
| MailerLite | mailerlite-webhooks |
Verify MailerLite webhook signatures (Signature header, HMAC-SHA256 hex of the raw body keyed with the webhook secret), handle subscriber and campaign events like subscriber.created, subscriber.unsubscribed and campaign.sent |
| MailerSend | mailersend-webhooks |
Verify MailerSend webhooks (Signature header, HMAC-SHA256 hex over the raw body), handle the webhook.test URL-validation ping and activity.sent, activity.delivered, activity.hard_bounced, activity.opened, activity.clicked, and activity.spam_complaint events |
| Mailgun | mailgun-webhooks |
Verify Mailgun webhook signatures (HMAC-SHA256), handle email delivered, failed, opened, clicked, unsubscribed, and complained events |
| Mailjet | mailjet-webhooks |
Authenticate Mailjet email event webhooks (no signature; Basic auth credentials in the webhook URL arrive as Authorization: Basic, compared in constant time), handle sent, open, click, bounce, blocked, spam, and unsub events, including grouped event arrays |
| Mailparser | mailparser-webhooks |
Authenticate Mailparser Advanced Webhooks — no signature; constant-time compare of the Additional Header you attach (X-Webhook-Secret or Authorization: Basic ...), handle the parsed email data JSON and per-row table requests |
| Mailtrap | mailtrap-webhooks |
Verify Mailtrap webhook signatures (Mailtrap-Signature, HMAC-SHA256 hex of the raw body keyed with the 32-hex signing secret as text), handle delivery, open, click and bounce events |
| MaintainX | maintainx-webhooks |
Verify MaintainX webhook signatures (x-maintainx-webhook-body-signature, HMAC-SHA256 over t.body), handle NEW_WORK_ORDER, WORK_ORDER_STATUS_CHANGE, NEW_WORK_REQUEST, and ASSET_STATUS_CHANGE events |
| Make | make-webhooks |
Authenticate requests from a Make scenario's HTTP module (unsigned: API key keychain header compared in full in constant time), route scenario payloads on a user-defined event field |
| Marketo | marketo-webhooks |
Authenticate Marketo Smart Campaign webhooks (no signature; shared-secret custom header such as X-Webhook-Secret), handle lead_created and lead_updated payloads |
| Mautic | mautic-webhooks |
Verify Mautic webhook signatures (Webhook-Signature, HMAC-SHA256 base64 of the raw body; not Standard Webhooks), handle events like mautic.lead_post_save_new and mautic.form_on_submit |
| Maximizer | maximizer-webhooks |
Authenticate Maximizer CRM webhooks (unsigned: a target header compared in full in constant time), handle Entity/Op changes like AbEntry create and Opportunity update |
| Maxio | maxio-webhooks |
Verify Maxio (formerly Chargify) webhook signatures (X-Chargify-Webhook-Signature-Hmac-Sha-256, HMAC-SHA256 hex over the raw form-encoded body, keyed with the Site Shared Key), parse the payload[...]&event=... body, handle signup_success, payment_success, payment_failure, renewal_success, and subscription_state_change events |
| MeasureOne | measureone-webhooks |
Authenticate MeasureOne webhooks (static secret header from delivery_details.headers, compared in constant time), handle events like datarequest.report_complete, datarequest.items_available and item.processed |
| Medplum | medplum-webhooks |
Verify Medplum webhooks (x-signature: hex HMAC-SHA256 of the raw body), handle FHIR Subscription notifications |
| Medusa | medusa-webhooks |
Verify Medusa Cloud webhook signatures (X-Medusa-Signature t=<unix>,v1=<hex>, HMAC-SHA256 hex over {t}.{raw_body} keyed with the endpoint signing secret, opt-in freshness check), handle build.created, build.succeeded, build.failed, deployment.created, deployment.succeeded, and deployment.failed events |
| MeetGeek | meetgeek-webhooks |
Verify MeetGeek webhooks (X-MG-Signature: hex HMAC-SHA256 of the raw body), handle meeting analysis notifications |
| Meeting BaaS | meeting-baas-webhooks |
Verify Meeting BaaS webhook signatures (svix-id, svix-timestamp, svix-signature, HMAC-SHA256, whsec_ secret), handle bot.completed, bot.status_change, bot.chat_message, bot.failed and calendar.event_created events |
| Meilisearch | meilisearch-webhooks |
Authenticate Meilisearch task webhooks (unsigned: the whole Authorization value compared in constant time), gunzip and split the ndjson body, handle task types like documentAdditionOrUpdate and settingsUpdate |
| Memberful | memberful-webhooks |
Verify Memberful webhooks (x-memberful-webhook-signature: hex HMAC-SHA256 of the raw body), handle member, subscription and order events |
| Memos | memos-webhooks |
Verify Memos webhooks (Standard Webhooks: webhook-id, webhook-timestamp, webhook-signature, whsec_ secret), handle memo and comment events |
| Mercury | mercury-webhooks |
Verify Mercury webhook signatures (Mercury-Signature t=<ts>,v1=<hex>, HMAC-SHA256 over {t}.{body}), handle transaction.created, transaction.updated, and account balance events, dispatched by resourceType and operationType |
| Metabase | metabase-webhooks |
Authenticate Metabase alert webhooks (unsigned HTTP Basic auth compared in constant time), handle alert payloads with question results |
| Metronome | metronome-webhooks |
Verify Metronome webhooks (Metronome-Webhook-Signature: hex HMAC-SHA256 of X-Metronome-Date, a newline, then the body), handle contract, commit, credit, invoice and alert events |
| Mews POS | mews-pos-webhooks |
Verify Mews POS webhooks (X-Signature: base64 HMAC-SHA256 of the raw body), handle booking, order and product availability events |
| MICEtribe | micetribe-webhooks |
Verify MICEtribe webhooks (X-Signature: hex HMAC-SHA256 of {X-Timestamp}.{body}), handle registration created, updated, deleted, attended and printed events |
| Microsoft Dynamics 365 | microsoft-dynamics-webhooks |
Authenticate Dataverse webhooks, which are not signed: register the HttpHeader authentication option (e.g. X-Webhook-Secret) and compare it in constant time, avoid WebhookKey/HttpQueryString (secret in the URL); parse the RemoteExecutionContext body and handle Create, Update and Delete messages by MessageName and PrimaryEntityName |
| Microsoft Graph | microsoft-graph-webhooks |
Validate Microsoft Graph change notifications (validationToken handshake, clientState, rich-notification JWTs), manage subscription lifecycle |
| Microsoft SharePoint | microsoft-sharepoint-webhooks |
Answer the SharePoint validationtoken handshake, validate clientState (no HMAC), handle thin list notifications and resolve changes via GetChanges (ItemAdded, ItemUpdated, ItemDeleted) |
| Middesk | middesk-webhooks |
Verify Middesk KYB webhook signatures (X-Middesk-Signature-256, HMAC-SHA256 hex of the raw body), handle business.created, business.updated and order.updated events |
| Mighty Networks | mighty-networks-webhooks |
Authenticate Mighty Networks webhooks (unsigned: Authorization: Bearer <API key> compared in constant time), handle MemberJoined, MemberPurchased, PostCreated and RsvpCreated events |
| Missive | missive-webhooks |
Verify Missive rule webhook signatures (X-Hook-Signature sha256=<hex>, HMAC-SHA256 of the raw body keyed with the validation secret), handle rule events by rule.type |
| Mistral | mistral-webhooks |
Verify Mistral voice agent webhook signatures (x-mistral-signature, HMAC-SHA256), handle call_started, call_ended and call_failed events |
| Modem Pay | modem-pay-webhooks |
Verify Modem Pay webhooks (x-modem-signature, hex HMAC-SHA512 of the raw body), handle charge, payment intent, customer and transfer events |
| Modern Treasury | modern-treasury-webhooks |
Verify Modern Treasury webhook signatures (X-Signature, hex HMAC-SHA256 of the raw body keyed with the webhook key), route on the X-Topic header plus body event, deduplicate on X-Webhook-ID, and handle payment_order.completed, payment_order.failed, payment_order.reconciled, expected_payment.reconciled, and incoming_payment_detail.completed events |
| Mollie | mollie-webhooks |
Verify next-gen Mollie webhooks (X-Mollie-Signature HMAC-SHA256) and handle unsigned classic webhooks by fetching payment status from the API (fetch-to-confirm) |
| monday.com | monday-webhooks |
Verify monday.com webhook JWTs and the challenge handshake, handle item, column value, and update events |
| Monerium | monerium-webhooks |
Verify Monerium webhooks (Standard Webhooks: webhook-id, webhook-timestamp, webhook-signature, whsec_ secret), handle order and subscription events |
| Moneybird | moneybird-webhooks |
Verify Moneybird webhook signatures (Moneybird-Signature t=<ts>,v1=<hex>, HMAC-SHA256 over {t}.{body}, any matching v1 during secret rotation), handle sales_invoice_created, sales_invoice_state_changed_to_paid, and contact_created actions dispatched by action |
| MongoDB Atlas | mongodb-atlas-webhooks |
Verify MongoDB Atlas alert webhooks (X-MMS-Signature, base64 HMAC-SHA1 of the raw body, only sent when a Webhook Secret is set), handle OUTSIDE_METRIC_THRESHOLD and HOST_DOWN alerts with OPEN/CLOSED status |
| Mono | mono-webhooks |
Authenticate Mono webhooks (unsigned: the mono-webhook-secret header compared in constant time), handle account connection and DirectPay payment events |
| MoonPay | moonpay-webhooks |
Verify MoonPay webhook signatures (Moonpay-Signature-V2 t=<ts>,s=<hex>, HMAC-SHA256 over {t}.{body} keyed with the webhook API key), handle transaction_created and transaction_updated |
| Morta | morta-webhooks |
Verify Morta webhooks (morta-signature: t=/v1= hex HMAC-SHA256 of {t}.{body}), handle project, table, document and member events |
| Motive | motive-webhooks |
Verify Motive (formerly KeepTruckin) fleet webhooks (X-KT-Webhook-Signature, hex HMAC-SHA1 of the raw body keyed with the shared secret), pass the activation test request, handle vehicle_location_updated, fault_code_opened, fault_code_closed, and user_upserted actions |
| Mux | mux-webhooks |
Verify Mux webhook signatures (mux-signature header, t=<timestamp>,v1=<sig>, HMAC-SHA256 hex over <timestamp>.<raw_body>), handle video.asset.ready, video.asset.errored, video.upload.asset_created, and video.live_stream events |
| n8n | n8n-webhooks |
Authenticate requests sent by an n8n workflow's HTTP Request node (unsigned: Header auth shared secret, Bearer or Basic auth compared in constant time), route workflow payloads on a user-defined event field |
| Nango | nango-webhooks |
Verify Nango integrations-platform webhooks (X-Nango-Hmac-Sha256: hex HMAC-SHA256 of the raw body, keyed with the environment webhook signing key, not the API key) with the @nangohq/node SDK or manually, and handle auth (connection creation, override, refresh, deletion), sync, forward and async_action webhooks |
| Nash | nash-webhooks |
Receive and verify Nash (usenash.com) delivery orchestration webhooks, sent through Svix (svix-id, svix-timestamp, svix-signature; HMAC-SHA256 base64 over {id}.{timestamp}.{raw body} keyed with the whsec_ secret), and dispatch the { type, event, data } payload for task.created, task.canceled_by_provider, delivery.dropoff_complete, courier_location.updated and shift.dispatched |
| Navattic | navattic-webhooks |
Authenticate Navattic webhooks (unsigned: the whole Authorization value, Basic
10BC8
or Bearer, compared in constant time), handle session_closed events |
| Needle | needle-webhooks |
Verify Needle webhooks (Standard Webhooks: webhook-id, webhook-timestamp, webhook-signature, whsec_ secret), handle lead, message, campaign and account events |
| Neon | neon-webhooks |
Verify Neon Auth webhook signatures (EdDSA / Ed25519 detached JWS via JWKS, X-Neon-Signature), handle user.created, user.before_create, send.otp, send.magic_link, and phone_number.verified events |
| New Relic | new-relic-webhooks |
Authenticate New Relic alert webhook destinations (unsigned Basic auth compared in constant time), handle issue activated, acknowledged and closed notifications from your template |
| Nextcloud | nextcloud-webhooks |
Authenticate Nextcloud webhook_listeners requests (unsigned: a secret header compared in full in constant time, any HTTP method), handle event.class events like NodeCreatedEvent and NodeWrittenEvent |
| Nexthink | nexthink-webhooks |
Authenticate Nexthink outbound-connector webhooks (unsigned: the whole Authorization Bearer value compared in constant time), handle the alert and workflow payloads your template sends |
| NextPay | nextpay-webhooks |
Verify NextPay webhook signatures (Svix svix-id, svix-timestamp, svix-signature, HMAC-SHA256, whsec_ secret), handle v2.payment_intent.succeeded, payout_request.processed and payout.failed events |
| NinjaOne | ninjaone-webhooks |
Authenticate NinjaOne (NinjaRMM) activity webhooks (unsigned; constant-time compare of the custom X-Webhook-Secret header set through PUT /v2/webhook — console notification-channel webhooks can't carry a header), handle CONDITION TRIGGERED / RESET, ACTION and ACTIONSET activities identified by activityType + statusCode |
| Nitrosend | nitrosend-webhooks |
Verify Nitrosend webhooks (Standard Webhooks: webhook-id, webhook-timestamp, webhook-signature, whsec_ secret), handle email, campaign and flow events |
| Nium | nium-webhooks |
Authenticate Nium webhooks (unsigned: the static header agreed at onboarding, e.g. x-partner-key, compared in full in constant time), handle events by template such as REMIT_TRANSACTION_PAID_WEBHOOK |
| NMI | nmi-webhooks |
Verify NMI (Network Merchants) Webhook-Signature (t=<nonce>,s=<sig>, HMAC-SHA256 over <nonce>.<raw_body>, hex) where t is a nonce not a timestamp, handle transaction.sale.success, transaction.auth.success, transaction.refund.success, and transaction.void.success events |
| Nomod | nomod-webhooks |
Verify Nomod webhook signatures (svix-signature, Svix HMAC-SHA256, whsec_ secret), handle charge.completed, charge.authorised, charge.failed and charge.refunded events |
| Nooks | nooks-webhooks |
Verify Nooks webhook signatures (x-webhook-signature t=<ms>,s=<base64>, HMAC-SHA256 over {t}.{body}), handle call.logged events |
| Northflank | northflank-webhooks |
Authenticate Northflank notification webhooks (X-Northflank-Notification-Integration-Token compared with your secret in constant time), handle build:success, build:failure and job-run:failure events |
| Northpass | northpass-webhooks |
Verify Northpass webhooks (X-Northpass-Hmac-SHA256: base64 HMAC-SHA256 of the raw body), handle learner, course and learning path events |
| Notifuse | notifuse-webhooks |
Verify Notifuse webhooks (Standard Webhooks: webhook-id, webhook-timestamp, webhook-signature, whsec_ secret), handle contact, list, segment and email events |
| Notion | notion-webhooks |
Verify Notion webhook signatures (HMAC-SHA256, X-Notion-Signature), complete handshake, handle page and comment events |
| Novu | novu-webhooks |
Verify Novu webhooks (Standard Webhooks: webhook-id, webhook-timestamp, webhook-signature, whsec_ secret), handle email, message, preference and workflow events |
| Nuvemshop | nuvemshop-webhooks |
Verify Nuvemshop (Tiendanube) webhook signatures (HMAC-SHA256 hex over raw body, x-linkedstore-hmac-sha256), handle order/created, order/paid, product/updated, and app/uninstalled events |
| Nylas | nylas-webhooks |
Verify Nylas v3 webhook signatures (x-nylas-signature, HMAC-SHA256), answer the challenge handshake, handle CloudEvents-format grant, message, and calendar events |
| Oh Dear | oh-dear-webhooks |
Verify Oh Dear webhooks (ohdear-signature: hex HMAC-SHA256 of the raw body), handle uptime, certificate, broken link and monitor notifications |
| Okta | okta-webhooks |
Complete the Okta Event Hook verification challenge, authenticate deliveries, handle user lifecycle and session events |
| Omnara | omnara-webhooks |
Verify Omnara webhooks (Standard Webhooks: webhook-id, webhook-timestamp, webhook-signature, base64 secret), handle agent timeline and tool-call events |
| Omnisend | omnisend-webhooks |
Authenticate Omnisend automation webhooks (user-chosen secret header such as X-Webhook-Secret, compared in constant time), handle template-defined events like subscribed and placed order |
| OnceHub | oncehub-webhooks |
Verify OnceHub v2 webhook signatures (Oncehub-Signature t=<ts>,s=<hex>, HMAC-SHA256 hex over {t}.{raw_body}, opt-in timestamp window), handle booking.scheduled, booking.rescheduled, booking.canceled, booking.completed and booking.no_show events |
| OneLogin | onelogin-webhooks |
Authenticate OneLogin Event Broadcaster webhooks (unsigned: a secret custom header compared in full in constant time), handle batched events by event_type_id such as login success and failure |
| OneSpan | onespan-webhooks |
Authenticate OneSpan Sign callbacks (the whole Authorization: Basic <callback key> value compared in constant time), handle events like PACKAGE_COMPLETE and DOCUMENT_SIGNED |
| Onfido | onfido-webhooks |
Verify Onfido (Entrust Identity Verification) webhook signatures (X-SHA2-Signature, HMAC-SHA256 hex over the raw body, keyed with the webhook token), handle check.completed, report.completed, and workflow_run.completed events |
| Onfleet | onfleet-webhooks |
Answer the unsigned GET ?check= URL validation handshake, verify X-Onfleet-Signature (HMAC-SHA512 over the raw body, keyed with the hex-decoded org secret), handle task, worker and route-plan triggers |
| Onramper | onramper-webhooks |
Verify Onramper webhooks (X-Onramper-Webhook-Signature: hex HMAC-SHA256 of the raw body), handle transaction status updates |
| Onshape | onshape-webhooks |
Verify Onshape webhooks (X-onshape-webhook-signature-primary: base64 HMAC-SHA256 of {timestamp}.{body}), handle model, document, revision and comment events |
| OpenAI | openai-webhooks |
Verify OpenAI webhooks for fine-tuning, batch, and realtime async events |
| OpenClaw | openclaw-webhooks |
Verify OpenClaw automation webhooks (Authorization: Bearer <webhookToken>), handle finished-run events and failure alerts |
| Openlayer | openlayer-webhooks |
Verify Openlayer webhooks (Standard Webhooks: webhook-id, webhook-timestamp, webhook-signature, whsec_ secret), handle test and test result events |
| OpenMeter | openmeter-webhooks |
Verify OpenMeter (Kong) notification webhooks delivered via Svix (svix-id, svix-timestamp, svix-signature; HMAC-SHA256 over {id}.{timestamp}.{body}), handle entitlements.balance.threshold, entitlements.reset, invoice.created and invoice.updated |
| OpenRouter | openrouter-webhooks |
Verify OpenRouter video-generation callbacks (X-OpenRouter-Signature: t=...,v1= hex HMAC-SHA256 of {t},{body}), handle completed, failed, cancelled and expired jobs |
| OpnForm | opnform-webhooks |
Verify OpnForm webhooks (x-webhook-signature: sha256= hex HMAC-SHA256 of the raw body), handle form submissions |
| Opsgenie | opsgenie-webhooks |
Authenticate Opsgenie Webhook integration calls (unsigned: a secret custom header compared in full in constant time), handle alert actions like Create, Acknowledge and Close |
| Optimizely | optimizely-webhooks |
Verify Optimizely webhooks (X-Hub-Signature: sha1= hex HMAC-SHA1 of the raw body), handle datafile and change-history events |
| Orb | orb-webhooks |
Verify Orb webhook signatures (HMAC-SHA256 over v1:{X-Orb-Timestamp}:{body}), handle customer, subscription, and invoice events |
| Ordinal | ordinal-webhooks |
Receive Ordinal (tryordinal.com) social-media content planning webhooks — there is no signature, HMAC or signing secret, so authenticate with a static custom header you set yourself via the webhook's headers field (e.g. X-Webhook-Secret) using a constant-time compare that fails closed, then unwrap the { type, data, createdAt } envelope for post.published, post.publish_failed, post.approval.requested, post.comment.created and social_profile.reconnect_needed. Not Bitcoin Ordinals |
| Origami | origami-webhooks |
Verify Origami webhooks (Standard Webhooks: webhook-id, webhook-timestamp, webhook-signature, whsec_ secret), handle job, table run and sequence events |
| Ory | ory-webhooks |
Authenticate Ory Actions webhooks (unsigned: api_key auth in a header, compared in full in constant time), handle non-blocking registration, login and settings hooks |
| Oura | oura-webhooks |
Complete the Oura subscription handshake, verify x-oura-signature (HMAC-SHA256 over timestamp + body, UPPERCASE), handle sleep, daily_readiness, daily_activity, and workout events |
| Outhire | outhire-webhooks |
Verify Outhire webhooks (Standard Webhooks: webhook-id, webhook-timestamp, webhook-signature, whsec_ secret), handle candidate events |
| Outreach | outreach-webhooks |
Verify Outreach webhook signatures (Outreach-Webhook-Signature, HMAC-SHA256 hex of the raw body, requires a webhook secret), handle prospect.created, sequenceState.created and call.created events |
| OxaPay | oxapay-webhooks |
Verify OxaPay webhooks (HMAC: hex HMAC-SHA512 of the raw body), handle payment and payout status callbacks |
| Oyster | oyster-webhooks |
Authenticate Oyster webhooks (the whole Authorization: Bearer <sharedSecret> value compared in constant time), handle eventNames like hiring.employment_engaged and expenses.expense_approved |
| Paddle | paddle-webhooks |
Verify Paddle webhook signatures, handle subscription and billing events |
| PagerDuty | pagerduty-webhooks |
Verify PagerDuty V3 webhook subscriptions: X-PagerDuty-Signature carries one or MORE comma-separated v1=<hex> HMAC-SHA256 digests over the raw body (multiple entries = zero-downtime secret rotation, so accept a match against ANY of them), with no timestamp or nonce and therefore no replay window; de-duplicate on X-Webhook-Id, respond 202 inside the 5s budget, and handle all 31 incident.* / service.* / scribe.* event types |
| Palmetto Finance | palmetto-finance-webhooks |
Authenticate Palmetto Finance webhooks (unsigned: the server API key in the apiKey header, compared in constant time), handle account, application, contract and milestone events |
| Paperform | paperform-webhooks |
Authenticate Paperform submission webhooks (unsigned: a secret custom header compared in full in constant time), handle new and partial submission payloads |
| Paragon | paragon-webhooks |
Authenticate Paragon Webhook Destination requests (unsigned: user-added secret header, default Authorization, compared in constant time), handle workflow_failure and credentials_failure events |
| parcelLab | parcellab-webhooks |
Authenticate parcelLab tracking webhooks (unsigned HTTP Basic auth compared in constant time), handle events like onDispatch, onOutForDelivery and onDelivered |
| Particle | particle-webhooks |
Authenticate Particle webhook integrations (unsigned: a static custom header such as Authorization, compared in constant time), accept any request method, parse form-encoded or JSON device events like temperature and motion-detected |
| Partnero | partnero-webhooks |
Verify Partnero webhooks (Signature: hex HMAC-SHA256 of the raw body), handle partner, customer, transaction and reward events |
| Pax8 | pax8-webhooks |
Authenticate Pax8 partner Webhooks API notifications (unsigned: the whole Authorization value compared in constant time), handle subscription, invoice and client topic events |
| Paxos | paxos-webhooks |
Authenticate Paxos webhooks (unsigned: the API Key header you configure, compared in full in constant time), handle thin events like identity.approved and transfer.crypto_deposit.completed |
| PAY.JP | payjp-webhooks |
Authenticate PAY.JP webhooks (unsigned: the account's X-Payjp-Webhook-Token compared in constant time), handle charge, customer, subscription and transfer events |
| Paymob | paymob-webhooks |
Verify Paymob transaction callbacks (HMAC-SHA512 hex over 20 ordered fields, delivered as the ?hmac= query param — not a header, not the raw body), read transaction state from success/is_refunded/is_voided/is_capture booleans |
| PayNow | paynow-gg-webhooks |
Verify PayNow (paynow.gg) webhooks (PayNow-Signature: base64 HMAC-SHA256 of {PayNow-Timestamp}.{body}), handle order, payment, refund, delivery item and subscription events |
| PayPal | paypal-webhooks |
Verify PayPal webhook signatures (RSA-SHA256 with cert), handle payment, subscription, and order events |
| Paypercut | paypercut-webhooks |
Verify Paypercut webhooks (Paypercut-Signature: t=/v1= hex HMAC-SHA256 of {t}.{body}), handle payment, checkout, account and payout events |
| PayPro Global | paypro-global-webhooks |
Verify PayPro Global IPN webhooks (form-encoded): SIGNATURE (SHA256 over ORDER_ID+ORDER_STATUS+ORDER_TOTAL_AMOUNT+CUSTOMER_EMAIL+VALIDATION_KEY+TEST_MODE+IPN_TYPE_NAME) and HASH (MD5 of ORDER_ID+SecretKey), handle OrderCharged, OrderRefunded, and SubscriptionChargeSucceed events |
| Payrix Pro | payrix-pro-webhooks |
Authenticate Payrix Pro webhook alerts (unsigned: the Header Name and Header Value on the action, compared in constant time), accept any method, handle JSON or raw payloads |
| Payroc | payroc-webhooks |
Authenticate Payroc event subscription webhooks (unsigned: the Payroc-Secret header compared in constant time), handle CloudEvents for processing accounts and terminal orders |
| Paysafe | paysafe-webhooks |
Verify Paysafe Payments API webhooks (Signature header, HMAC-SHA256 base64 of the raw body keyed with the HMAC key), handle events like PAYMENT_HANDLE_COMPLETED |
| Paystack | paystack-webhooks |
Verify Paystack webhook signatures (x-paystack-signature, HMAC-SHA512), handle charge, transfer, and subscription events |
| Payt | payt-webhooks |
Verify Payt webhooks (x-payt-signature: hex HMAC-SHA256 of the raw body), handle invoice, case and reminder events |
| PayTabs | paytabs-webhooks |
Verify PayTabs webhooks (Signature: hex HMAC-SHA256 of the raw body), handle Sale and Refund transaction callbacks (IPN) |
| Pennylane | pennylane-webhooks |
Verify Pennylane webhook signatures (X-Pennylane-Signature t=<ts>,v1=<hex>, HMAC-SHA256 over {t}.{body}), handle customer_invoice.e_invoicing_status_updated, dms_file.created and supplier_invoice.e_invoicing_received events |
| People Data Labs | people-data-labs-webhooks |
Authenticate People Data Labs person-update webhooks (unsigned: the shared header compared in full in constant time), handle monthly batches of updated record IDs |
| Persona | persona-webhooks |
Verify Persona webhook signatures (Persona-Signature, t=/v1= HMAC-SHA256 pairs), handle inquiry and verification events |
| pganalyze | pganalyze-webhooks |
Verify pganalyze webhooks (Standard Webhooks: webhook-id, webhook-timestamp, webhook-signature, whsec_ secret), handle issue alert events |
| Picqer | picqer-webhooks |
Verify Picqer webhook signatures (X-Picqer-Signature, HMAC-SHA256 base64), handle order, picklist, and stock events |
| Pinata | pinata-webhooks |
Verify Pinata webhook signatures (webhook-id, webhook-timestamp, webhook-signature, HMAC-SHA256 via Svix), handle ipfs.public.file_added and ipfs.public.pin_by_cid_succeeded events |
| Pine Labs | pine-labs-webhooks |
Verify Pine Labs webhooks (Standard Webhooks: webhook-id, webhook-timestamp, webhook-signature, secret used as raw UTF-8 bytes), handle order, payment, refund, token and subscription events |
| PingOne | pingone-webhooks |
Authenticate PingOne subscription webhooks (unsigned: an admin-set header compared in full in constant time), handle audit action.types like USER.CREATED |
| Pipecat Cloud | pipecat-cloud-webhooks |
Verify Pipecat Cloud webhook signatures (svix-id, svix-timestamp, svix-signature, HMAC-SHA256, whsec_ secret), handle build.succeeded, deployment.updated, service.suspended and spend.limit_reached events |
| Pipedream | pipedream-webhooks |
Verify Pipedream Connect trigger webhook signatures (x-pd-signature: t=<unix>,v1=<hex>, HMAC-SHA256 over <t>.<raw body>, 5-minute replay window), and handle the unsigned CONNECTION_SUCCESS / CONNECTION_ERROR connection webhooks |
| Pipedrive | pipedrive-webhooks |
Authenticate Pipedrive webhooks (HTTP Basic Auth — no signature), handle create.deal, change.person, and delete.activity events |
| Pipeline CRM | pipeline-crm-webhooks |
Verify Pipeline CRM automation webhooks (Standard Webhooks: webhook-id, webhook-timestamp, webhook-signature, whsec_ secret; opt-in signing), handle deal, person and company events |
| Plain | plain-webhooks |
Verify Plain webhook request signatures (Plain-Request-Signature, HMAC-SHA256 hex of the raw body keyed with the workspace HMAC secret), handle thread.thread_created, thread.email_received, thread.thread_status_transitioned, and customer.customer_created events |
| Plane | plane-webhooks |
Verify Plane webhooks (x-plane-signature: hex HMAC-SHA256 of the raw body), handle project, cycle, module and work item events |
| PlanetScale | planetscale-webhooks |
Verify PlanetScale webhooks (x-planetscale-signature: hex HMAC-SHA256 of the raw body), handle branch, deploy request, backup and cluster events |
| Planning Center | planning-center-webhooks |
Verify Planning Center webhook signatures (X-PCO-Webhooks-Authenticity, HMAC-SHA256 hex of the raw body keyed with the authenticity_secret), handle people.v2.events.person.updated and other EventDelivery events |
| Pleo | pleo-webhooks |
Verify Pleo webhooks (Standard Webhooks via Svix, webhook-signature HMAC-SHA256), handle v1.export-job.created and v1.vendor.created events |
| Plunk | plunk-webhooks |
Authenticate Plunk workflow webhook steps (unsigned: a static secret header you set, compared in constant time), accept the step's method, handle contact and workflow payloads |
| Podium | podium-webhooks |
Verify Podium webhooks (podium-signature: hex HMAC-SHA256 of {podium-timestamp}.{body}), handle message, contact, review, call and invoice events |
| Polar | polar-webhooks |
Verify Polar webhook signatures (Standard Webhooks), handle order, subscription, and checkout events |
| Polytomic | polytomic-webhooks |
Authenticate Polytomic webhooks (static shared bearer token in Authorization — NO signature, NO HMAC; Polytomic-Signature-Timestamp is an RFC 3339 timestamp, not a digest), handle the single sync.records event and loop over the object.records[] batch |
| PostHog | posthog-webhooks |
Verify PostHog webhook signatures (webhook-id, webhook-timestamp, webhook-signature, Standard Webhooks HMAC-SHA256), handle $pageview, $identify and custom events |
| Postmark | postmark-webhooks |
Authenticate Postmark webhooks (Basic Auth/Token), handle email delivery, bounce, open, click, and spam events |
| Postscript | postscript-webhooks |
Authenticate Postscript webhooks (unsigned: the Postscript-Signature account token, not an HMAC, compared in constant time), handle events like shop.subscriber.opt_in and shop.incoming_message |
| Praxis | praxis-webhooks |
Verify Praxis (Cashier) webhook signatures (gt-authentication, SHA-384 hex over ordered field values + Merchant Secret — not HMAC, not Standard Webhooks), sign the acknowledgement (external-request-signature), handle Payment Notification transaction_status (pending, approved, rejected, error) and Subscription Notification events |
| Preczn | preczn-webhooks |
Verify Preczn webhooks (X-Preczn-Signature: v1= hex HMAC-SHA256 of the raw body), handle transaction, merchant, loan and form events |
| Prefect | prefect-webhooks |
Authenticate Prefect Custom Webhook notifications (unsigned: a secret header on the block compared in full in constant time), handle automation notifications rendered from your template |
| Printify | printify-webhooks |
Verify Printify webhook signatures (X-Pfy-Signature, sha256= hex HMAC-SHA256 of the raw body), handle order:created, order:shipment:created, order:shipment:delivered and product:publish:started events |
| Prive (Recurly Commerce) | prive-webhooks |
Verify Prive (now Recurly Commerce) webhook signatures (x-prive-hmac-sha256, base64 HMAC-SHA256 of the raw body), handle subscription and billing-attempt topics |
| Prividium | prividium-webhooks |
Verify Prividium webhooks (Standard Webhooks: webhook-id, webhook-timestamp, webhook-signature, whsec_ secret), handle event and address webhooks |
| Privy | privy-webhooks |
Verify Privy webhook signatures (svix-id, svix-timestamp, svix-signature, HMAC-SHA256, whsec_ secret), handle user.created, transaction.confirmed and wallet.funds_deposited events |
| Procore | procore-webhooks |
Authenticate Procore webhooks (unsigned: the whole Authorization value compared in constant time), handle resource create, update and delete events |
| project44 | project44-webhooks |
Authenticate project44 webhooks (unsigned API_KEY auth header compared in full in constant time), handle eventTypes like shipments.v1.event.added and shipments.v1.state.updated |
| Prometheus Alertmanager | prometheus-alertmanager-webhooks |
Authenticate Prometheus Alertmanager webhook receivers (unsigned: Authorization Bearer credentials or basic_auth from http_config, compared in constant time), handle firing and resolved alert groups |
| Proof | proof-webhooks |
Verify Proof webhooks (X-Notarize-Signature: hex HMAC-SHA256 of the raw body), handle transaction and notary events |
| PropelAuth | propelauth-webhooks |
Verify PropelAuth webhooks (delivered by Svix: svix-signature HMAC-SHA256 base64 with a whsec_ secret), handle user and organization events like user.created, user.deleted and org.created |
| Proxyclick (Eptura Visitor) | proxyclick-webhooks |
Authenticate Proxyclick (Eptura Visitor) webhooks (unsigned HTTP Basic auth compared in constant time), handle visitor check-in, check-out and visit events |
| PubNub | pubnub-webhooks |
Authenticate PubNub Events & Actions webhooks (unsigned: a secret custom header compared in full in constant time), handle events by dataSchema like messages.pubsub.publish and user.created |
| Pulumi Cloud | pulumi-webhooks |
Verify Pulumi Cloud webhooks (Pulumi-Webhook-Signature: hex HMAC-SHA256 of the raw body), handle stack, update, deployment and drift events |
| Purchasely | purchasely-webhooks |
Verify Purchasely webhooks (X-PURCHASELY-REQUEST-SIGNATURE: hex HMAC-SHA256 of X-PURCHASELY-TIMESTAMP followed by the body), handle subscription, offer and entitlement events |
| Pusher Channels | pusher-webhooks |
Verify Pusher Channels webhook signatures (X-Pusher-Signature, HMAC-SHA256 hex digest of the raw body keyed with the app secret of the key named in X-Pusher-Key), handle batched channel_occupied, channel_vacated, member_added, member_removed, client_event, cache_miss, and subscription_count events |
| Pylon | pylon-webhooks |
Verify Pylon webhook signatures (Pylon-Webhook-Signature, hs256= HMAC-SHA256 over timestamp.body), handle B2B support issue events like issue.created and issue.updated |
| Qlik Cloud | qlik-cloud-webhooks |
Verify Qlik Cloud webhooks (qlik-signature: hex HMAC-SHA256 of the raw body), handle app, reload, automation and user events |
| Qonto | qonto-webhooks |
Verify Qonto webhooks (X-Qonto-Signature: t=/v1= hex HMAC-SHA256 of {t}.{body}), handle transaction, card and transfer events |
| Quickbase | quickbase-webhooks |
Authenticate Quickbase table webhooks (unsigned: a secret header compared in full in constant time, any HTTP method), handle record added, modified and deleted requests |
| QuickBooks Online | quickbooks-webhooks |
Verify QuickBooks Online webhook signatures (intuit-signature, HMAC-SHA256 base64 keyed with the Verifier Token), handle CloudEvents (qbo.invoice.created.v1) and legacy eventNotifications payloads across multiple realms |
| Quicknode | quicknode-webhooks |
Verify Quicknode Streams and Webhooks deliveries (X-QN-Signature: hex HMAC-SHA256 of nonce + timestamp + body), handle block and transaction payloads |
| Quo | quo-webhooks |
Verify Quo (formerly OpenPhone) webhooks across BOTH of its signature schemes — the current Standard Webhooks style webhook-id/webhook-timestamp/webhook-signature (HMAC-SHA256 base64 over {id}.{timestamp}.{raw-body}, whsec_ key) and the legacy openphone-signature (hmac;1;<ms-timestamp>;<base64> over {timestamp}.{raw-body}) — branch on the data.resource vs data.object envelope, and handle message.received, call.completed, call.summary.completed, contact.updated and task.* events. Not Quoter |
| Quoter | quoter-webhooks |
Verify Quoter webhooks (weak MD5 hash form field over HASH_KEY + timestamp + data, NOT HMAC and NOT Standard Webhooks — the hash key is optional), parse the x-www-form-urlencoded hash/timestamp/data payload, dispatch Quote, Person, and Payment create/update deliveries by ?object= |
| Railway | railway-webhooks |
Authenticate Railway webhooks (unsigned: a secret custom header compared in full in constant time), handle deployment and alert events like Deployment.failed |
| Ramp | ramp-webhooks |
Verify Ramp webhook signatures (X-Ramp-Signature, hex HMAC-SHA256 of the raw body), answer the webhooks.verification challenge, handle transaction, bill, and reimbursement events like transactions.authorized, transactions.cleared, reimbursements.ready_for_review |
| RapidAPI | rapidapi-webhooks |
Authenticate RapidAPI Enterprise Hub event webhooks (unsigned: the x-rapidapi-webhook-secret value compared in constant time), handle hub events like API and subscription changes |
| Razorpay | razorpay-webhooks |
Verify Razorpay webhook signatures (X-Razorpay-Signature, HMAC-SHA256), handle payment and order events |
| Rebilly | rebilly-webhooks |
Authenticate Rebilly webhooks (Authorization: Basic HTTP basic auth, compared in constant time; Security-Signature JWT and v1a Ed25519 signatures explained), accept GET, POST, PUT, PATCH and DELETE, handle transaction-processed, subscription-activated and invoice-issued events by eventType |
| Rebrandly | rebrandly-webhooks |
Authenticate Rebrandly Clickstream and webhook deliveries (unsigned: a header you name, compared in constant time), accept POST or PUT, handle click batches |
| Recall.ai | recall-ai-webhooks |
Verify Recall.ai webhook signatures (Standard Webhooks webhook-* headers or legacy svix-*, base64 HMAC-SHA256 with a whsec_ secret), handle bot status, recording, transcript, calendar and real-time participant events |
| Recharge | recharge-webhooks |
Verify Recharge webhooks (X-Recharge-Hmac-Sha256, plain SHA-256 of secret + body, not HMAC), handle charge, subscription, and order events |
| Recruitee | recruitee-webhooks |
Verify Recruitee webhook signatures (X-Recruitee-Signature, HMAC-SHA256 hex over the raw body), handle new_candidate, candidate_moved, and candidate_assigned events |
| Recurly | recurly-webhooks |
Authenticate Recurly webhooks (Basic Auth), parse XML notifications for subscription and payment events |
| Recurrente | recurrente-webhooks |
Verify Recurrente webhook signatures (svix-id, svix-timestamp, svix-signature, HMAC-SHA256, whsec_ secret), handle intent.succeeded, subscription and verification events |
| Reditus | reditus-webhooks |
Verify Reditus webhooks (x-signature: hex HMAC-SHA256 of the raw body), handle partnership, referral, lead and reward events |
| Redo | redo-webhooks |
Authenticate Redo return webhooks (unsigned: the whole Authorization: Bearer <secret> value compared in constant time), handle return.created and return.updated |
| Reducto | reducto-webhooks |
Verify Reducto async job webhooks (delivered via Svix: svix-id/svix-timestamp/svix-signature, HMAC-SHA256, whsec_ secret), handle async.update notifications with job status Completed or Failed |
| ReferralHero | referralhero-webhooks |
Verify ReferralHero webhooks (X-ReferralHero-Signature: base64 HMAC-SHA256 of the raw body), handle subscriber and reward events |
| Relay | relay-messenger-webhooks |
Verify Relay webhook signatures (webhook-id, webhook-timestamp, webhook-signature, Standard Webhooks HMAC-SHA256, whsec_ secret), handle message.received, message.sent, message.failed, reaction and participant events |
| Remote | remote-webhooks |
Verify Remote webhooks (X-Remote-Signature: hex HMAC-SHA256 of {body}:{X-Remote-Timestamp}), handle employment, contract, payroll and time-off events |
| Render | render-webhooks |
Verify Render Standard Webhooks signatures (webhook-id, webhook-timestamp, webhook-signature), handle deploy, build, outage, cron job and Postgres events like deploy_ended and server_failed |
| Replicate | replicate-webhooks |
Verify Replicate webhook signatures, handle ML prediction lifecycle events |
| Requesty | requesty-webhooks |
Verify Requesty webhooks (Standard Webhooks: webhook-id, webhook-timestamp, webhook-signature, whsec_ secret), handle budget and balance alerts |
| Resend | resend-webhooks |
Verify Resend webhook signatures, handle email delivery and bounce events |
| Retell AI | retell-webhooks |
Verify Retell webhook signatures (X-Retell-Signature, HMAC-SHA256), handle voice call events like call_started, call_ended, call_analyzed |
| Returnless | returnless-webhooks |
Verify Returnless webhooks (X-Signature: hex HMAC-SHA256 of the raw body), handle return request, return and shipment events |
| Rev.ai | rev-ai-webhooks |
Authenticate Rev.ai job notifications (the whole Authorization: Bearer <token> value from notification_config.auth_headers, compared in constant time), handle transcribed and failed jobs |
| RevenueCat | revenuecat-webhooks |
Verify RevenueCat webhooks (opt-in HMAC signature or static Authorization header), handle in-app subscription events like INITIAL_PURCHASE, RENEWAL and EXPIRATION |
| Revolut | revolut-webhooks |
Verify Revolut Merchant API webhook signatures (Revolut-Signature, HMAC-SHA256 over v1.{timestamp}.{body}), handle order events |
| Rewardful | rewardful-webhooks |
Verify Rewardful webhooks (X-Rewardful-Signature: hex HMAC-SHA256 of the raw body), handle affiliate, referral, sale, commission and payout events |
| RingCentral | ringcentral-webhooks |
Complete the RingCentral Validation-Token handshake, check the optional Verification-Token header, handle message-store, presence, and telephony session events |
| Roam | roam-webhooks |
Verify Roam webhooks (Standard Webhooks: webhook-id, webhook-timestamp, webhook-signature, whsec_ secret), handle chat.message and meeting.ended events |
| Rocketlane | rocketlane-webhooks |
Authenticate Rocketlane webhooks (unsigned HTTP Basic auth compared in constant time), handle eventTypes like TASK_CREATED and TASK_UPDATED |
| RocketReach | rocketreach-webhooks |
Verify RocketReach webhook signatures (X-RocketReach-Signature, HMAC-SHA256 base64), handle People Lookup and Bulk People Lookup results |
| ROLLER | roller-webhooks |
Authenticate ROLLER webhooks (unsigned: the x-roller-apikey value compared in constant time), handle types like Booking.Created, Booking.Cancelled and Redemption.Created |
| Root | root-platform-webhooks |
Verify Root webhooks (X-Hook-Signature-256: hex HMAC-SHA256 of the raw body), handle policy, policyholder, claim and payment events |
| RootFi (Commenda) | rootfi-webhooks |
Verify RootFi (Commenda) webhooks (X-RootFi-Signature: t=/v1= hex HMAC-SHA256 of {t}.{body}), handle sync, data model and connection events |
| Rubrik | rubrik-webhooks |
Authenticate Rubrik Security Cloud webhooks (unsigned: custom header, Bearer token, or Basic auth), parse the default PD-CEF payload or custom templates, han 10BC8 dle backup Failure/Success and Anomaly events |
| RudderStack | rudderstack-webhooks |
Authenticate RudderStack HTTP Webhook destination calls (unsigned Basic auth compared in constant time), handle forwarded track and identify events |
| Runa | runa-webhooks |
Verify Runa webhooks (delivered by Svix: svix-id, svix-timestamp, svix-signature, whsec_ secret), handle order.completion and product.update events |
| Rutter | rutter-webhooks |
Verify Rutter (unified commerce and accounting API) webhook signatures (X-Rutter-Signature / X-Rutter-Signatures, sha256= + base64 HMAC-SHA256 over the raw body keyed with the client secret, any-match across the list during secret rotation), handle events routed on code such as INITIAL_UPDATE, CONNECTION_NEEDS_UPDATE, ORDER_CREATED and INVOICE_UPDATED |
| Ryft | ryft-webhooks |
Verify Ryft webhooks (Signature: hex HMAC-SHA256 of the raw body), handle payment session, account, payout and dispute events |
| SafeBase | safebase-webhooks |
Verify SafeBase trust center webhooks (delivered by Svix: svix-id, svix-timestamp, svix-signature, whsec_ Signing Secret), handle access request, account, portal and questionnaire events |
| Sahha | sahha-webhooks |
Verify Sahha webhook signatures (X-Signature, HMAC-SHA256 hex of the raw body), handle ScoreCreatedIntegrationEvent, BiomarkerCreatedIntegrationEvent and ArchetypeCreatedIntegrationEvent events |
| sajn | sajn-webhooks |
Verify sajn webhook signatures (Standard Webhooks: webhook-id, webhook-timestamp, webhook-signature, HMAC-SHA256, whsec_ secret), handle document.completed, document.party.signed and document.party.delivery_failed events |
| SaladCloud | salad-cloud-webhooks |
Verify SaladCloud webhook signatures (webhook-id, webhook-timestamp, webhook-signature, Standard Webhooks HMAC-SHA256, base64 secret), handle queue.job.succeeded events |
| Salesforce | salesforce-webhooks |
Handle Salesforce Outbound Messages (SOAP/XML), validate OrganizationId, return the required Ack response |
| Salesloft | salesloft-webhooks |
Verify Salesloft webhook signatures (x-salesloft-signature, HMAC-SHA1 hex of the raw body keyed with the subscription's callback_token), handle events like person_created and call_created |
| Salsa | salsa-webhooks |
Verify Salsa webhooks (Standard Webhooks: webhook-id, webhook-timestamp, webhook-signature, whsec_ secret), handle Employer.created, Worker.updated and PayrollRun.awaitingInput events |
| Sanity | sanity-webhooks |
Verify Sanity GROQ-powered webhook signatures (sanity-webhook-signature, HMAC-SHA256 base64url), handle document change events |
| SAP Emarsys | emarsys-webhooks |
Authenticate SAP Emarsys Automation Center Webhook node calls (Authorization: Basic credentials compared in constant time), handle preset-defined contact and event_data payloads |
| SAP SuccessFactors | sap-successfactors-webhooks |
Authenticate SAP SuccessFactors Integration Center REST outbound calls (HTTP Basic auth compared in constant time), accept GET or POST, handle author-mapped JSON or XML payloads |
| SavvyCal | savvycal-webhooks |
Verify SavvyCal webhook signatures (x-savvycal-signature, HMAC-SHA256 hex of the raw body, optional sha256= prefix, any case), handle event.created, event.rescheduled and event.canceled events |
| Scalekit | scalekit-webhooks |
Verify Scalekit webhooks (Standard Webhooks: webhook-id, webhook-timestamp, webhook-signature, whsec_ secret), handle organization, user, directory and role events |
| Scaleway Topics and Events | scaleway-topics-and-events-webhooks |
Verify Scaleway Topics and Events (SNS-compatible) messages against Scaleway's CA trust chain, confirm HTTP/S subscriptions, handle Notification envelopes |
| Schematic | schematic-webhooks |
Verify Schematic webhooks (X-Schematic-Webhook-Signature: hex HMAC-SHA256 of {body}+{timestamp}), handle company, user, plan, flag and entitlement events |
| Scrapfly | scrapfly-webhooks |
Verify Scrapfly webhook signatures (HMAC-SHA256, uppercase/lowercase hex), dispatch scrape, extraction, and screenshot jobs |
| SeaTable | seatable-webhooks |
Verify SeaTable webhook signatures (X-Seatable-Signature sha256=<hex>, HMAC-SHA256 of the raw body), handle row change events like insert_row, modify_row and delete_row |
| Segment | segment-webhooks |
Verify Segment Webhooks (Actions) signatures (X-Signature, HMAC-SHA1 hex; batches sign only the first event), handle track, identify, page, screen, group, and alias calls |
| Semaphore CI | semaphore-webhooks |
Verify Semaphore CI webhooks (x-semaphore-signature-256: hex HMAC-SHA256 of the raw body), handle pipeline-finished notifications |
| Semble | semble-webhooks |
Verify Semble webhook signatures (X-Webhook-Signature t=<ts>,v1=<hex>, HMAC-SHA256 over {t}.{body}), handle booking.created and invoice.paid events |
| Sendbird | sendbird-webhooks |
Verify Sendbird Chat webhook signatures (x-sendbird-signature, HMAC-SHA256 hex of the raw body keyed with the master API token), handle group_channel:message_send, group_channel:create, group_channel:join, open_channel:message_send, and user:block events |
| Sendcloud | sendcloud-webhooks |
Verify Sendcloud webhook signatures (Sendcloud-Signature, HMAC-SHA256 hex of the raw body keyed with the integration secret), handle parcel_status_changed, return_created and integration_updated actions |
| SendGrid | sendgrid-webhooks |
Verify SendGrid webhook signatures (ECDSA), handle email delivery events |
| Sendoso | sendoso-webhooks |
Verify Sendoso Svix signatures (svix-id, svix-timestamp, svix-signature, per-endpoint whsec_ secret), handle corporate gifting send status events like send.shipped, send.delivered and send.redeemed (payload carries send_gid and status_changed_at only) |
| SendX | sendx-webhooks |
Verify SendX webhooks (x-sendx-signature: hex HMAC-SHA256 of the raw body), handle engagement events (opens, clicks, bounces, unsubscribes) |
| Sent | sent-dm-webhooks |
Verify Sent (sent.dm) webhook signatures (X-Webhook-Signature, Standard Webhooks HMAC-SHA256 with a whsec_ secret), handle message.delivered, message.failed, message.received and templates.approved events |
| Sentry | sentry-webhooks |
Verify Sentry Integration Platform webhook signatures (Sentry-Hook-Signature, and Sentry-App-Signature on UI-component requests — HMAC-SHA256 lowercase hex over the RAW body, keyed with the integration Client Secret), route on the Sentry-Hook-Resource header since the body carries no event type, handle issue, error, comment, event_alert, metric_alert, seer and preprod_artifact events |
| Sevalla | sevalla-webhooks |
Authenticate Sevalla webhooks (svl-signature carries the whsec_ secret itself, not a signature: compared in constant time), handle APP_DEPLOY, STATIC_SITE_DEPLOY and other app and static site events |
| Ship24 | ship24-webhooks |
Authenticate Ship24 tracking webhooks (unsigned: Authorization: Bearer <webhook secret> compared in constant time), handle tracking/events and tracking/pod messages |
| ShipBob | shipbob-webhooks |
Verify ShipBob webhook signatures (Standard Webhooks/Svix, webhook-signature), dispatch on x-webhook-topic, handle order.shipped, delivery, return, and WRO events |
| ShipHero | shiphero-webhooks |
Verify ShipHero webhook signatures (x-shiphero-hmac-sha256, base64 HMAC-SHA256 of the raw body), dispatch on the payload webhook_type field, handle Order Allocated, Shipment Update, Inventory Update, and Return Update events |
| Shippo | shippo-webhooks |
Verify Shippo webhook signatures (Shippo-Auth-Signature, t=…,v1=… hex HMAC-SHA256 over {t}.{body}; HMAC provisioned by Shippo on request) with a URL-token fallback, handle track_updated, transaction_created/updated, batch, and automations_label_resolved events |
| ShipStation | shipstation-webhooks |
Handle ShipStation V1 thin-payload webhooks (fetch resource_url with Basic auth), cover ORDER_NOTIFY and SHIP_NOTIFY events |
| Shopify | shopify-webhooks |
Verify Shopify HMAC signatures, handle order and product webhook events |
| SHOPLINE | shopline-webhooks |
Verify SHOPLINE HMAC signatures (X-Shopline-Hmac-Sha256, base64 with hex fallback), handle orders/create, products/update, and collect/delete events |
| Shopware | shopware-webhooks |
Verify Shopware app webhook signatures (shopware-shop-signature, HMAC-SHA256 hex of the raw body keyed with the shop's app secret), handle events like checkout.order.placed |
| Shortcut | shortcut-webhooks |
Verify Shortcut webhook signatures (Payload-Signature, HMAC-SHA256 hex of the raw body), handle story, epic and comment actions |
| Sigfox | sigfox-webhooks |
Authenticate Sigfox custom callbacks (unsigned: a secret header set in the callback, compared in full in constant time), handle GET, POST or PUT data uplink, service status and error callbacks |
| Signal Sciences (Fastly Next-Gen WAF) | signal-sciences-webhooks |
Verify Signal Sciences generic webhook signatures (hex HMAC-SHA256 of the raw body in X-SigSci-Signature, no timestamp), handle flag, expireFlag, agentAlert, loggingModeChanged, and ruleCreated events |
| SignNow | signnow-webhooks |
Verify SignNow webhook signatures (X-SignNow-Signature, HMAC-SHA256 base64 of the raw body keyed with the subscription secret_key), handle document.complete, document.fieldinvite.signed and user.document.complete events |
| Simpro | simpro-webhooks |
Verify Simpro webhooks (X-Response-Signature: hex HMAC-SHA1 of the raw body with your subscription Secret), handle job, customer, invoice and quote events by ID |
| Sinch | sinch-webhooks |
Verify Sinch Conversation API callbacks (x-sinch-webhook-signature: base64 HMAC-SHA256 of {body}.{nonce}.{timestamp}), handle message, delivery report and contact callbacks |
| Skovik | skovik-webhooks |
Verify Skovik webhooks (Standard Webhooks: webhook-id, webhook-timestamp, webhook-signature, whsec_ secret), handle users.created, export_orders.completed and branches.updated events |
| Slack | slack-webhooks |
Verify Slack Events API signatures (HMAC-SHA256, X-Slack-Signature), handle message, app_mention, and reaction events |
| Smartcar | smartcar-webhooks |
Verify Smartcar webhook signatures (SC-Signature, hex HMAC-SHA256 keyed with the Application Management Token), answer the VERIFY challenge, handle VEHICLE_STATE and VEHICLE_ERROR events |
| Smartsheet | smartsheet-webhooks |
Verify Smartsheet webhook signatures (Smartsheet-Hmac-SHA256, HMAC-SHA256 hex of the raw body), answer the Smartsheet-Hook-Challenge handshake, handle row.created, cell.updated and sheet.updated events |
| Smile API | smile-webhooks |
Verify Smile API (getsmileapi.com, SE Asia employment/income data — not Smile.io or Smile Identity) webhook signatures (Smile-Signature, HMAC-SHA512 hex over the raw body), dedupe on the event id, handle ACCOUNT_CONNECTED, TASK_FINISHED, INCOMES_ADDED, EMPLOYMENTS_ADDED, IDENTITY_ADDED, and RECORD_COMPLETED events |
| SMTP2GO | smtp2go-webhooks |
Authenticate SMTP2GO email and SMS webhooks (unsigned: the whole Authorization value compared in constant time), parse JSON or form-encoded events |
| Snipcart | snipcart-webhooks |
Verify Snipcart webhooks — there is NO signature and NO HMAC: validate the one-time X-Snipcart-RequestToken by calling GET https://app.snipcart.com/api/requestvalidation/{token} with HTTP Basic auth (secret API key as username, trailing colon), fail closed on 404/401/timeout; handle order.completed, order.status.changed, order.paymentStatus.changed, order.refund.created and the v3/-prefixed subscription events, plus the synchronous shippingrates.fetch and taxes.calculate webhooks |
| Socotra | socotra-webhooks |
Verify Socotra webhooks (socotra-signature: t=/v1= hex HMAC-SHA256 of {t}.{body}), handle policy, quote and billing events |
| Socure | socure-webhooks |
Authenticate Socure RiskOS webhooks (unsigned HTTP Basic auth compared in constant time), handle event_types like evaluation_completed and case_status_updated |
| Sohar Health | sohar-health-webhooks |
Verify Sohar Health webhook signatures (Svix: svix-id, svix-timestamp, svix-signature, HMAC-SHA256), handle verification.updated, verification.pending, discovery.updated, flow.updated and flow.callback events |
| Solidgate | solidgate-webhooks |
Verify Solidgate webhook signatures (merchant + signature headers, HMAC-SHA512 with base64-of-hex double-encode), handle card_gate.order.updated, subscription.updated.v2, and chargeback events |
| SonarQube | sonarqube-webhooks |
Verify SonarQube webhook signatures (X-Sonar-Webhook-HMAC-SHA256, HMAC-SHA256 hex of the raw body), handle analysis results by qualityGate.status OK and ERROR |
| Soniox | soniox-webhooks |
Authenticate Soniox async transcription webhooks (unsigned: the per-request header you name, compared in constant time), handle completed and error statuses |
| Sovos | sovos-webhooks |
Verify Sovos e-invoicing (Indirect Tax API) webhooks delivered via Svix (svix-id/svix-timestamp/svix-signature, HMAC-SHA256 base64 over {id}.{timestamp}.{raw_body}, whsec_ secret from the Consumer App Portal), dispatch on eventType for document.received, document.completed, workflow.completed, and system.error |
| Spacebring | spacebring-webhooks |
Verify Spacebring webhook signatures (svix-id, svix-timestamp, svix-signature, HMAC-SHA256 via Svix, whsec_ secret), handle booking.created, membership.created and shop.order.paid events |
| Spacelift | spacelift-webhooks |
Verify Spacelift webhooks (X-Signature-256: sha256= hex HMAC-SHA256 of the raw body), handle run state changes and internal errors |
| SparkPost | sparkpost-webhooks |
Authenticate SparkPost event webhooks (unsigned: Basic Auth, OAuth 2.0 Bearer, or legacy X-MessageSystems-Webhook-Token), parse the batched msys array, dedupe on X-MessageSystems-Batch-ID, handle delivery, bounce, click, spam_complaint, and list_unsubscribe events |
| Speechmatics | speechmatics-webhooks |
Authenticate Speechmatics batch job notifications (unsigned: your auth_headers value compared in full in constant time), handle success and error callbacks by the status query parameter |
| Speed | speed-webhooks |
Verify Speed webhook signatures (webhook-id, webhook-timestamp, webhook-signature, Standard Webhooks with a wsec_ secret), handle payment.paid, payment.confirmed and checkout_session.paid events |
| SpherePay | spherepay-webhooks |
Verify SpherePay webhooks (Sphere-Signature: hex HMAC-SHA256 of {Sphere-Timestamp}.{body}, whsec_ secret used as-is), handle customer and transfer events |
| Spike API | spike-api-webhooks |
Verify Spike API webhooks (x-body-signature: hex HMAC-SHA256 of the raw body), handle record changes and provider integration events |
| Spree Commerce | spree-webhooks |
Verify Spree Commerce webhooks (X-Spree-Webhook-Signature: hex HMAC-SHA256 of {X-Spree-Webhook-Timestamp}.{body}), handle order, payment, fulfillment and customer events |
| Square | square-webhooks |
Verify Square webhook signatures (x-square-hmacsha256-signature over URL + body), handle payment and refund events |
| Statsig | statsig-webhooks |
Verify Statsig Event Webhook signatures (HMAC-SHA256 over v0:ts:body, X-Statsig-Signature), handle exposure and config-change batches |
| Stedi | stedi-webhooks |
Verify Stedi event destination webhooks (Standard Webhooks: webhook-id, webhook-timestamp, webhook-signature, HMAC-SHA256 base64 with a whsec_ secret), handle healthcare events like transaction.processed, file.failed and enrollment.activated |
| Stigg | stigg-webhooks |
Authenticate Stigg webhooks (unsigned: Stigg-Webhooks-Secret header compared with the webhook secret in constant time), handle customer.created, subscription.created, subscription.canceled and entitlements.updated events |
| Stitch | stitch-webhooks |
Verify Stitch (stitch.money) webhooks delivered via Svix (svix-signature, HMAC-SHA256 over id.timestamp.body), handle payment, payment.confirmation, transaction, payment-consent-request, collection, refund, and disbursement status events |
| Storekit | storekit-webhooks |
Verify Storekit webhook signatures (svix-id, svix-timestamp, svix-signature, HMAC-SHA256 via Svix), handle order.created.v2, order.refund.succeeded, store.closed and item.out_of_stock events |
| Storyblok | storyblok-webhooks |
Verify Storyblok webhook signatures (webhook-signature, HMAC-SHA1 hex of the raw body; not Standard Webhooks), handle story actions like published and unpublished |
| Storylane | storylane-webhooks |
Verify Storylane webhooks (x-storylane-signature: base64 HMAC-SHA256 of the raw body), handle demo viewed events |
| Strapi | strapi-webhooks |
Authenticate Strapi webhooks (unsigned: an auth header you add per webhook or via defaultHeaders, compared in full in constant time), handle entry.*, media.* and release events |
| Strava | strava-webhooks |
Complete the Strava subscription validation handshake (hub.challenge/hub.verify_token), handle activity and athlete deauthorization events |
| Streak | streak-webhooks |
Authenticate Streak webhooks (unsigned: the X-Streak-Webhook-Token value compared in constant time), handle events like BOX_CREATE and BOX_CHANGE_STAGE |
| Stream (getstream.io) | stream-webhooks |
Verify Stream (getstream.io) webhook signatures (X-Signature, HMAC-SHA256 hex of the raw body keyed with the app API secret; leave payload compression off), handle message.new, reaction.new and member.added events |
| Stripe | stripe-webhooks |
Verify Stripe webhook signatures, parse payment event payloads, handle checkout.session.completed events |
| Stuart | stuart-webhooks |
Authenticate Stuart delivery webhooks (unsigned: your X- authentication header compared in full in constant time), handle v3 topics like package_created, courier_assigned and package_delivered |
| Stytch | stytch-webhooks |
Verify Stytch webhooks delivered via Svix (svix-id, svix-timestamp, svix-signature, HMAC-SHA256 over id.timestamp.body, whsec_ secret), derive the event type from source/object_type/action, handle direct.user.create, direct.member.update, direct.organization.create, and direct.saml_connection.delete events |
| Sublime Security | sublime-security-webhooks |
Verify Sublime Security webhooks (X-Sublime-Signature: t=...,v0=...: hex HMAC-SHA256 of <t>.<raw body>), handle message.flagged, group and manual Action events |
| Sumsub | sumsub-webhooks |
Verify Sumsub webhook digests (x-payload-digest, HMAC hex of the raw body with the algorithm named in x-payload-digest-alg: SHA256, SHA512 or legacy SHA1), handle applicantReviewed, applicantPending and applicantCreated events |
| Supabase | supabase-webhooks |
Handle both Supabase surfaces: Database Webhooks (INSERT/UPDATE/DELETE via pg_net triggers, unsigned — authenticate with a developer-configured shared-secret header) and Auth Hooks (Standard Webhooks HMAC-SHA256 over {webhook-id}.{webhook-timestamp}.{raw_body}, v1,whsec_ secret), covering send_email, send_sms, custom_access_token, before_user_created, mfa_verification_attempt, and password_verification_attempt |
| Supertab | supertab-webhooks |
Verify Supertab webhook signatures (Svix: svix-id, svix-timestamp, svix-signature, HMAC-SHA256, webhook-* fallback), handle purchase.completed and onetime_offering.purchasing_completed events |
| Superwall | superwall-webhooks |
Verify Superwall webhooks (delivered by Svix: svix-id, svix-timestamp, svix-signature, whsec_ secret), handle subscription lifecycle events (purchase, renewal, cancellation, refund) |
| Surge | surge-webhooks |
Verify Surge webhooks (Standard Webhooks: webhook-id, webhook-timestamp, webhook-signature, whsec_ secret, HMAC-SHA256), handle message.received, message.delivered, message.failed and contact.opted_out events |
| SurveyMethods | surveymethods-webhooks |
Verify SurveyMethods webhooks (X-SurveyMethods-Signature: sha256= hex HMAC-SHA256 of the raw body), handle survey response and survey events |
| Survicate | survicate-webhooks |
Verify Survicate webhooks (Hmac: hex HMAC-SHA256 of the raw body), handle question answered and survey completed events |
| Svix | svix-webhooks |
Verify Svix-delivered webhook signatures (svix-signature/webhook-signature, HMAC-SHA256) for any provider that sends webhooks via Svix |
| Swan | swan-webhooks |
Authenticate Swan webhooks (unsigned: the subscription's x-swan-secret compared in constant time), handle thin <Resource>.<Action> notifications |
| Swipelux | swipelux-webhooks |
Verify Swipelux webhooks (delivered by Svix: svix-id, svix-timestamp, svix-signature, whsec_ secret), handle customer, account and transfer events |
| Swoogo | swoogo-webhooks |
Authenticate Swoogo webhooks (unsigned: a custom header compared in full in constant time), handle registrant, contact and session changes |
| Synctera | synctera-webhooks |
Verify Synctera BaaS webhooks (custom HMAC-SHA256 hex over {Request-Timestamp}.{raw_body}, Synctera-Signature + Request-Timestamp headers, secret from POST /v0/webhook_secrets, rolling secret support), handle ACCOUNT.UPDATED, CARD.CREATED, TRANSACTION.CREATED, and DISPUTE.CREATED events |
| Tabby | tabby-webhooks |
Authenticate Tabby payment and dispute webhooks (unsigned: the secret header set at registration, X-Auth-Key by default, compared in constant time), handle payment statuses like authorized, closed and rejected and dispute statuses |
| Taiga | taiga-webhooks |
Verify Taiga webhook signatures (X-TAIGA-WEBHOOK-SIGNATURE, HMAC-SHA1 hex of the raw body), handle create, change and delete events for user stories, tasks, issues and epics |
| Tailscale | tailscale-webhooks |
Verify Tailscale webhook signatures (Tailscale-Webhook-Signature t=<unix>,v1=<hex>, HMAC-SHA256 hex over {t}.{raw_body} keyed with the tskey-webhook- secret, 5-minute freshness check), handle batched JSON-array events like nodeCreated, nodeNeedsApproval, nodeApproved, nodeKeyExpiringInOneDay, nodeDeleted, policyUpdate, and userCreated |
| Tally | tally-webhooks |
Verify Tally webhook signatures (Tally-Signature, HMAC-SHA256 base64, optional signing secret), handle FORM_RESPONSE submission events |
| Tanium | tanium-webhooks |
Authenticate Tanium Connect HTTP destination deliveries (unsigned: Header Authentication, the header you name compared in constant time), accept the method you choose, handle JSON record batches |
| Taskade | taskade-webhooks |
Verify Taskade webhooks (X-Taskade-Signature: sha256= hex HMAC-SHA256 of the raw body), handle task, comment and project events |
| Taskrabbit | taskrabbit-webhooks |
Verify Taskrabbit Partner API webhooks delivered via Svix (svix-id/svix-timestamp/svix-signature, HMAC-SHA256 base64, whsec_ secret from the Svix Partner Dashboard), handle project.completed, project.canceled, and project.rescheduled events |
| tawk.to | tawk-to-webhooks |
Verify tawk.to webhook signatures (X-Tawk-Signature, HMAC-SHA1 hex of the raw body), handle chat:start, chat:end, chat:transcript_created and ticket:create events |
| Teachfloor | teachfloor-webhooks |
Verify Teachfloor webhooks (teachfloor-signature: hex HMAC-SHA256 of the raw body), handle course, module, element and member events |
| Teamwork.com | teamwork-webhooks |
Verify Teamwork Projects webhook signatures (X-Projects-Signature, HMAC-SHA256 hex over the raw body with the Version 2 webhook token), handle TASK.CREATED, TASK.COMPLETED, PROJECT.CREATED, and COMMENT.CREATED events from the X-Projects-Event header |
| Tebex | tebex-webhooks |
Verify Tebex webhook signatures (X-Signature, two-step HMAC-SHA256 of the SHA-256 body hash), answer the validation.webhook handshake, handle payment, dispute, and recurring-payment events |
| Telegram | telegram-webhooks |
Verify Telegram Bot API webhooks via the X-Telegram-Bot-Api-Secret-Token header (setWebhook secret_token, constant-time compare; no HMAC), route on the Update field present: message, edited_message, callback_query, inline_query, my_chat_member |
| Telnyx | telnyx-webhooks |
Verify Telnyx Webhook API v2 signatures (Ed25519, telnyx-signature-ed25519 + telnyx-timestamp), handle message.received, message.sent, and message.finalized events |
| Tensorlake | tensorlake-webhooks |
Verify Tensorlake webhooks (delivered by Svix: svix-id, svix-timestamp, svix-signature, whsec_ secret), handle tensorlake.sandbox.failed, tensorlake.sandbox.running and tensorlake.application.request.completed events |
| Terminal | terminal-telematics-webhooks |
Verify Terminal webhook signatures (svix-id, svix-timestamp, svix-signature, HMAC-SHA256 via Svix), handle sync.completed, connection.created and connection.disconnected events |
| Terminal49 | terminal49-webhooks |
Verify Terminal49 webhook signatures (X-T49-Webhook-Signature, hex HMAC-SHA256 of the raw body), handle tracking_request.succeeded, container.transport.vessel_arrived and container.updated events |
| Terra API | terra-api-webhooks |
Verify Terra API webhooks (terra-signature: t=/v1= hex HMAC-SHA256 of {t}.{body}), handle auth lifecycle and health data events |
| Texture | texture-webhooks |
Verify Texture webhooks (Texture-Signature: hex HMAC-SHA256 of the raw body), handle device, command, customer and site events |
| TextUs | textus-webhooks |
Verify TextUs webhook signatures (X-TextUs-Signature, HMAC-SHA256 hex of the raw body keyed with the whole textus- secret), handle message and contact events |
| TheirStack | theirstack-webhooks |
Verify TheirStack webhook signatures (X-TheirStack-Signature-256 sha256=<hex>, HMAC-SHA256 of the raw body), handle job.new and company.new events |
| Thinkific | thinkific-webhooks |
Verify Thinkific webhooks (X-Thinkific-Hmac-Sha256: hex HMAC-SHA256 of the raw body), handle order, enrollment, user and course events |
| Thought Industries | thought-industries-webhooks |
Verify Thought Industries webhooks (X-Ti-Hook-Signature: sha256= hex HMAC-SHA256 of the raw body), handle course, learning path and quiz events |
| Threads | threads-webhooks |
Verify Threads (Meta) webhook signatures (X-Hub-Signature-256 sha256=<hex>, HMAC-SHA256 of the raw body keyed with the app secret), answer the hub.challenge handshake, handle replies, mentions, publish and delete |
| Tidio | tidio-webhooks |
Verify Tidio webhooks (x-tidio-signature: t=...,s= hex HMAC-SHA256 of {body}_{t}), handle contact, conversation, ticket and satisfaction events |
| Tikkie | tikkie-webhooks |
Receive Tikkie API v2 (ABN AMRO) notifications, which carry no signature, secret, or HMAC. Check subscriptionId against the id returned by POST /paymentrequestssubscription / /transactionssubscription, re-fetch the record with API-Key + X-App-Token, and dispatch notificationType PAYMENT, REFUND, and BUNDLE |
| TikTok | tiktok-webhooks |
Verify TikTok for Developers webhook signatures (TikTok-Signature, HMAC-SHA256 hex over <timestamp>.<body>), handle authorization.removed, video.upload.failed, video.publish.completed, and portability.download.ready events |
| TikTok Shop | tiktok-shop-webhooks |
Verify TikTok Shop webhook signatures (Authorization header, HMAC-SHA256 over app_key + body), handle order, package, and product events |
| Tiltify | tiltify-webhooks |
Verify Tiltify webhooks (X-Tiltify-Signature: base64 HMAC-SHA256 of {X-Tiltify-Timestamp}.{body}), handle donation and fact updates |
| TIMIFY | timify-webhooks |
Authenticate TIMIFY webhook subscriptions (unsigned: the Include header name header, its whole value compared in constant time), handle booking, customer and resource changes; Sync webhooks are not supported |
| Todoist | todoist-webhooks |
Verify Todoist webhook signatures (X-Todoist-Hmac-SHA256, HMAC-SHA256 base64 of the raw body keyed with the app's client secret), handle events like item:added and item:completed |
| Toggl Track | toggl-webhooks |
Verify Toggl Track webhook signatures (X-Webhook-Signature-256 sha256=<hex>, HMAC-SHA256 of the raw body), handle PING subscription validation and time_entry.created and project.updated events |
| Token.io | tokenio-webhooks |
Verify Token.io open banking webhook signatures (asymmetric Ed25519, token-signature over the raw body, token-event for the type), subscribe via PUT /webhook/config, handle PAYMENT_STATUS_CHANGED, REFUND_STATUS_CHANGED, VRP_STATUS_CHANGED, and VIRTUAL_ACCOUNT_CREDIT_RECEIVED events |
| Tokity | tokity-webhooks |
Verify Tokity webhooks (x-dd-signature: sha256= base64 HMAC-SHA256 of the raw body), handle ticket changes (with from previous state) and chat session updates |
| Tolt | tolt-webhooks |
Verify Tolt webhooks (delivered by Svix: svix-id, svix-timestamp, svix-signature, whsec_ secret), handle partner.created, customer.created, transaction.created and commission.created events |
| Top.gg | top-gg-webhooks |
Verify Top.gg v1 webhook signatures (x-topgg-signature t=<ts>,v1=<hex>, HMAC-SHA256 over {t}.{body} keyed with the whole whs_ secret), handle vote.create and webhook.test events |
| Torii | torii-webhooks |
Authenticate Torii workflow custom-action requests (unsigned: a secret header compared in full in constant time), handle the JSON bodies your workflows send |
| Trackstar | trackstar-webhooks |
Verify Trackstar webhook signatures (delivered by Svix: svix-id, svix-timestamp, svix-signature, HMAC-SHA256), handle order.created, order.updated and connection.historical-sync-completed events |
| Travtus | travtus-webhooks |
Verify Travtus webhooks (delivered by Svix: svix-id, svix-timestamp, svix-signature, whsec_ secret), handle lease, task, SMS and email events |
| Tray.io | tray-io-webhooks |
Authenticate requests from a Tray.io workflow's HTTP Client connector (unsigned: a secret header compared in full in constant time), route workflow payloads on an event field such as record.created |
| Treet | treet-webhooks |
Verify Treet webhooks (x-treet-signature: base64 HMAC-SHA256 of the raw body), handle shipping label events |
| Treezor | treezor-webhooks |
Verify Treezor BaaS webhook signatures (object_payload_signature body field, HMAC-SHA256 base64 over the canonicalized object_payload, not the raw body), handle banking events like payin.create, cardtransaction.create, and user.kycreview |
| Trello | trello-webhooks |
Verify Trello webhook signatures (x-trello-webhook, HMAC-SHA1 over body + callbackURL), answer the HEAD check, handle board and card actions |
| Tremendous | tremendous-webhooks |
Verify Tremendous webhook signatures (Tremendous-Webhook-Signature sha256=<hex>, HMAC-SHA256 of the raw body keyed with the webhook private_key), handle reward and order events |
| Trendyol | trendyol-webhooks |
Authenticate Trendyol order package webhooks (unsigned: the x-api-key header compared in constant time), handle package status changes in content[] |
| Trigger.dev | trigger-dev-webhooks |
Verify Trigger.dev alert webhooks (x-trigger-signature-hmacsha256, HMAC-SHA256 hex of the raw body), handle alert.run.failed and alert.deployment.failed events |
| TriNet Zenefits | zenefits-webhooks |
Verify TriNet Zenefits webhook signatures (signature header, HMAC-SHA256 hex of the raw body keyed with the webhook shared secret), handle people and employment events |
| Tripletex | tripletex-webhooks |
Authenticate Tripletex event subscriptions (unsigned: the authHeaderName header compared in full in constant time), handle events like invoice.charged and customer.create |
| Truework | truework-webhooks |
Authenticate Truework webhooks (X-Truework-Token header compared with the webhook token in constant time, no payload signature), handle order.completed and verification_request.state.change events |
| Trunk | trunk-webhooks |
Verify Trunk webhook signatures (svix-id, svix-timestamp, svix-signature, HMAC-SHA256, whsec_ secret), handle pull_request.merged, pull_request_batch.pending_failure and v2.test_case.status_changed events |
| TutorCruncher | tutorcruncher-webhooks |
Verify TutorCruncher webhooks (Webhook-Signature, hex HMAC-SHA256 of the raw body), handle CREATED_A_CONTRACTOR, CREATED_AN_APPOINTMENT, CLIENT_ENQUIRY and RAISED_INVOICE actions |
| Twenty | twenty-webhooks |
Verify Twenty CRM webhooks (X-Twenty-Webhook-Signature: hex HMAC-SHA256 of {X-Twenty-Webhook-Timestamp}:{body}), handle record created, updated and deleted events |
| Twilio | twilio-webhooks |
Verify Twilio webhook signatures (HMAC-SHA1, X-Twilio-Signature), handle SMS, voice, and status callback events |
| Twitch | twitch-webhooks |
Verify Twitch EventSub signatures (Twitch-Eventsub-Message-Signature, HMAC-SHA256), answer challenges, handle stream and channel events |
| Twitter/X | twitter-webhooks |
Verify Twitter/X Account Activity webhook signatures (x-twitter-webhooks-signature, HMAC-SHA256) and answer CRC challenges, handle tweet, favorite, and DM events |
| Typeform | typeform-webhooks |
Verify Typeform webhook signatures (Typeform-Signature, HMAC-SHA256 base64), handle form_response events |
| Typefully | typefully-webhooks |
Verify Typefully webhook signatures (X-Typefully-Si
10BC8
gnature sha256=<hex>, HMAC-SHA256 over {X-Typefully-Timestamp}.{body}), handle draft events like draft.created, draft.scheduled and draft.published |
| Uber | uber-webhooks |
Verify Uber Eats webhook signatures (HMAC-SHA256 hex, X-Uber-Signature, keyed with client secret), handle orders.notification, orders.cancel, and store events |
| UKG Ready | ukg-ready-webhooks |
Authenticate UKG Ready webhook subscriptions (unsigned: the whole Authorization: Bearer <token> value compared in constant time), handle account and employee change payloads |
| Ultravox | ultravox-webhooks |
Verify Ultravox webhooks (X-Ultravox-Webhook-Signature: hex HMAC-SHA256 of the body followed by X-Ultravox-Webhook-Timestamp), handle call started, joined, ended and billed events |
| Unipile | unipile-webhooks |
Receive Unipile webhooks (unsigned), authenticate them with a shared-secret header such as Unipile-Auth compared in constant time, handle message_received, mail_received and account status payloads |
| Unit | unit-webhooks |
Verify Unit webhook signatures (X-Unit-Signature, HMAC-SHA1 base64 of the raw body), handle account.created, customer.created, transaction.created, payment.clearing, and application.approved events |
| Uphold | uphold-webhooks |
Verify Uphold Enterprise webhook signatures (Svix scheme with Webhook-Id/Webhook-Timestamp/Webhook-Signature headers, HMAC-SHA256 base64 keyed with the decoded whsec_ secret), handle core.user.created, core.transaction.status-changed, core.account.balance-changed and KYC/KYB status events |
| Upload-Post | upload-post-webhooks |
Verify Upload-Post webhooks (X-Upload-Post-Signature: sha256= hex HMAC-SHA256 of {timestamp}.{body}, whsec_ secret used as-is), handle upload and social-account events |
| Uploadcare | uploadcare-webhooks |
Verify Uploadcare webhooks (x-uc-signature: v1= hex HMAC-SHA256 of the raw body), handle file upload, update, store, delete and infected events |
| Upollo | upollo-webhooks |
Verify Upollo fraud/risk webhook signatures (Upollo-Signature, t:/s0: HMAC-SHA512 over the raw body), react to flags like ACCOUNT_SHARING and MULTIPLE_ACCOUNTS and the recommended action (CHALLENGE/DENY/PERMIT) |
| UpPromote | uppromote-webhooks |
Verify UpPromote webhooks (X-UpPromote-Signature: hex HMAC-SHA256 of the raw body), handle referral, affiliate and payment events |
| useSend | usesend-webhooks |
Verify useSend webhooks (X-UseSend-Signature: v1= hex HMAC-SHA256 of {X-UseSend-Timestamp}.{body}, whsec_ secret used as-is), handle email, contact and domain events |
| USPS | usps-webhooks |
Verify USPS tracking webhook signatures (HMAC-SHA256 Base64 over timestamp + payload, X-HMAC), create tracking subscriptions, handle delivery events |
| Utila | utila-webhooks |
Verify Utila webhook signatures (x-utila-signature, asymmetric RSA-4096 + SHA-512 + PSS, no shared secret), handle TRANSACTION_CREATED, TRANSACTION_STATE_UPDATED, WALLET_CREATED, WALLET_ADDRESS_CREATED, and TRANSACTION_AML_SCREENING_RESULT_READY events |
| Vanta | vanta-webhooks |
Verify Vanta webhook signatures (Svix: svix-id/svix-timestamp/svix-signature, HMAC-SHA256 base64) with the official svix SDK, handle questionnaire, vendor decision, Trust Center access request, and audit evidence events |
| Vapi | vapi-webhooks |
Authenticate Vapi "Server URL" webhooks with a shared secret (Authorization: Bearer or legacy X-Vapi-Secret, timing-safe compare — Vapi has no fixed HMAC scheme; OAuth 2.0 and a configurable HMAC are also supported), dispatch on the nested message.type, and return the required JSON body for the request/response types assistant-request, tool-calls, transfer-destination-request, and knowledge-base-request |
| Vellum | vellum-webhooks |
Authenticate Vellum monitoring webhooks (API Key Header or Bearer Token compared in constant time, no signature), handle workflow.execution.fulfilled, workflow.execution.rejected and workflow.execution.initiated events |
| Velt | velt-webhooks |
Verify Velt Advanced (V2) webhooks (Standard Webhooks: webhook-id, webhook-timestamp, webhook-signature, whsec_ secret), handle comment_annotation.add, comment.add, crdt.update_data and recorder.done events |
| Ventrata | ventrata-webhooks |
Authenticate Ventrata OCTO webhooks (unsigned: a header from the webhook's headers map, compared in constant time), handle booking, order, availability and product updates |
| Vercel | vercel-webhooks |
Verify Vercel webhook signatures (HMAC-SHA1), handle deployment and project events |
| Vercel Log Drains | vercel-log-drains-webhooks |
Verify Vercel Log Drain deliveries (x-vercel-signature, HMAC-SHA1) and the x-vercel-verify handshake, handle batched json/ndjson log events |
| Veriff | veriff-webhooks |
Verify Veriff identity-verification webhook signatures (X-HMAC-SIGNATURE, hex HMAC-SHA256 of the raw body keyed with the integration's shared secret key; X-AUTH-CLIENT is not proof of authenticity), handle decision webhooks (verification.status approved, declined, resubmission_requested, review, expired, abandoned) and event webhooks (started, submitted, flow_finished, flow_cancelled) |
| Vern | vern-webhooks |
Verify Vern webhooks (delivered by Svix: svix-id, svix-timestamp, svix-signature, HMAC-SHA256, whsec_ secret), handle workbook.production.export and workbook.preview.export batches |
| Versive | versive-webhooks |
Verify Versive webhooks (delivered by Svix: svix-id, svix-timestamp, svix-signature, whsec_ secret), handle interview.completed events |
| VGS (Very Good Security) | vgs-webhooks |
Verify VGS (Very Good Security) webhook signatures (vgs-signature t=<ts>,v0=<hex>, HMAC-SHA256 over {t}.{body}), handle vault, route and user events like route.updated and vault.created |
| VideoAsk | videoask-webhooks |
Authenticate VideoAsk form webhooks (unsigned: a header set through the API compared in full in constant time), handle event_types like form_response |
| Vimeo | vimeo-webhooks |
Verify Vimeo app webhook signatures (X-Webhook-Signature, HMAC-SHA256 hex of the raw body), handle video events like video-transcode-complete and video-deleted |
| Violet | violet-webhooks |
Verify Violet webhooks (X-Violet-Hmac: base64 HMAC-SHA256 of the raw body), handle order, merchant, offer and payout events |
| Vitable Health | vitable-health-webhooks |
Verify Vitable Health webhooks (X-Vitable-Signature: sha512= hex HMAC-SHA512 of {X-Vitable-Timestamp}.{body}), handle enrollment and employee events |
| vivenu | vivenu-webhooks |
Verify vivenu webhooks (x-vivenu-signature: hex HMAC-SHA256 of the raw body), handle transaction, checkout, ticket and customer events |
| Voiceflow | voiceflow-webhooks |
Verify Voiceflow organization webhook signatures (delivered by Svix: svix-id, svix-timestamp, svix-signature, HMAC-SHA256, whsec_ secret), handle organization.project.created, organization.project.environment.published and organization.project.environment.merged events |
| Volume | volume-webhooks |
Verify Volume pay-by-bank webhooks (Authorization: SHA256withRSA <base64>, an RSA PKCS#1 v1.5 / SHA-256 signature over the RAW body checked against Volume's sandbox/live public key, no shared secret), accept PUT deliveries, and handle COMPLETED, SETTLED and FAILED payment statuses |
| VTEX | vtex-webhooks |
Authenticate VTEX Orders API hooks (unsigned: a secret in the hook headers, compared in full in constant time), answer the hookConfig ping and handle order status changes like payment-approved |
| WAHA (WhatsApp HTTP API) | waha-webhooks |
Verify WAHA (WhatsApp HTTP API) webhook signatures (X-Webhook-Hmac, HMAC-SHA512 hex of the raw body), handle events like message, message.ack and session.status |
| Walmart | walmart-webhooks |
Verify Walmart Marketplace performance webhook signatures (WM_SEC.SIGNATURE, HMAC-SHA256 over method + path + timestamp + body hash), handle PO_CREATED, INVENTORY_OOS, OFFER_PUBLISHED, and BUY_BOX_CHANGED events |
| Wave | wave-webhooks |
Verify Wave webhook signatures (x-wave-signature t=<ts>,v1=<hex>, HMAC-SHA256 over {t}.{body}), handle invoice.sent, invoice.viewed, invoice.paid, invoice.partially_paid, invoice.overdue, invoice.approved, estimate.sent, estimate.accepted, and checkout.paid events |
| Webex | webex-webhooks |
Verify Webex (formerly Cisco Spark) webhook signatures (X-Spark-Signature, hex HMAC-SHA1 of the raw body keyed with the optional webhook secret), handle messages.created, messages.deleted, memberships.created, rooms.updated, meetings.started and attachmentActions.created events, fetch message text by id |
| Webflow | webflow-webhooks |
Verify Webflow webhook signatures (HMAC-SHA256), handle form submission, ecommerce, and CMS events |
| WebinarJam | webinarjam-webhooks |
Authenticate WebinarJam and EverWebinar Custom Webhook deliveries (unsigned: Bearer token or custom header, the whole value compared in constant time), handle registration and attendance triggers |
| Webiny | webiny-webhooks |
Verify Webiny webhooks (Standard Webhooks: webhook-id, webhook-timestamp, webhook-signature, secret used as raw UTF-8 bytes), handle Webiny 6 app events |
| WeChat Pay | wechat-webhooks |
Verify WeChat Pay APIv3 notification signatures (Wechatpay-Signature, SHA256withRSA over {timestamp}\n{nonce}\n{body}\n with the platform public key), decrypt the AEAD_AES_256_GCM resource, handle TRANSACTION.SUCCESS, REFUND.SUCCESS, and REFUND.CLOSED events |
| WeTravel | wetravel-webhooks |
Verify WeTravel group-travel webhooks, delivered through a Svix App Portal (svix-id/svix-timestamp/svix-signature or webhook-*, HMAC-SHA256 base64 over {id}.{timestamp}.{raw body}, whsec_ secret; inferred, as WeTravel publishes no verification docs), handle booking.created, booking.updated, payment.created, transaction.created, trip.published, and lead.created events |
| Whatnot | whatnot-webhooks |
Verify Whatnot webhook signatures (Standard Webhooks — webhook-signature, base64 HMAC-SHA256 over {webhook-id}.{webhook-timestamp}.{body}, with the wn_wh_ secret prefix stripped and base64-decoded) and handle orders, shows, shipments, merchandising and products topics |
whatsapp-webhooks |
Verify WhatsApp Business Platform webhook signatures (X-Hub-Signature-256), complete the GET handshake, handle inbound messages and status updates |
|
| WHOOP | whoop-webhooks |
Verify WHOOP webhooks (X-WHOOP-Signature: base64 HMAC-SHA256 of X-WHOOP-Signature-Timestamp followed by the body, keyed with the app client secret), handle sleep, workout and recovery events |
| Whop | whop-webhooks |
Verify Whop webhook signatures (Standard Webhooks: webhook-id/webhook-timestamp/webhook-signature v1,<base64>, HMAC-SHA256 over {id}.{timestamp}.{raw body}, ws_ secret used as the literal key) with the official Whop SDK, handle payment.succeeded, payment.failed, membership.activated, membership.deactivated, and refund.created events |
| Wistia | wistia-webhooks |
Verify Wistia webhook signatures (X-Wistia-Signature, HMAC-SHA256 hex of the raw body), handle media.ready, media.created and viewing_session.play events |
| Wix | wix-webhooks |
Verify Wix webhook JWTs (RS256 with your app's public key) for self-hosted apps, handle wix.ecom.v1.order_created, order_approved, order_updated, and order_canceled events |
| Wiza | wiza-webhooks |
Authenticate Wiza webhooks (unsigned: x-auth-key is the SHA-256 hex of your API key, compared in constant time), handle individual_reveal results |
| WooCommerce | woocommerce-webhooks |
Verify WooCommerce webhook signatures, handle order, product, and customer events |
| WordPress.com | wordpress-com-webhooks |
Receive WordPress.com (Settings → Webhooks) deliveries, which are unsigned — no HMAC, no signature header, no secret, no timestamp, no handshake — so protect the endpoint with a constant-time query-string token (fail closed) and treat the flat application/x-www-form-urlencoded body as untrusted; dispatch on the hook field over publish_post, publish_page, and comment_post. Not WooCommerce (X-WC-Webhook-Signature) |
| Workable | workable-webhooks |
Verify Workable webhook signatures (X-Workable-Signature, HMAC-SHA256 hex keyed with the API token or OAuth app secret), handle candidate_created, candidate_moved and employee events |
| Workato | workato-webhooks |
Authenticate requests sent by a Workato recipe's HTTP connector action (unsigned: Authorization: Basic username and password compared in constant time, any HTTP method), route recipe payloads on a user-defined event field such as order.created and record.updated |
| WorkOS | workos-webhooks |
Verify WorkOS webhook signatures (WorkOS-Signature, HMAC-SHA256 with timestamp), handle Directory Sync and auth events |
| Workspace ONE (Omnissa) | workspace-one-webhooks |
Authenticate Workspace ONE UEM event notifications (unsigned HTTP Basic auth compared in constant time), handle device enrollment, compliance and wipe events |
| Xendit | xendit-webhooks |
Authenticate Xendit webhooks (x-callback-token header compared with the verification token in constant time), handle payment.capture, payment.failure, payment_token.activation and invoice PAID events |
| Xero | xero-webhooks |
Verify Xero webhook signatures (x-xero-signature, HMAC-SHA256 base64), pass Intent to Receive (ITR) with 200/401, handle CONTACT, INVOICE, CREDITNOTE, and SUBSCRIPTION events |
| Xtremepush | xtremepush-webhooks |
Verify Xtremepush webhook signatures (X-Xtremepush-Signature t=<ts>, v1=<hex>, HMAC-SHA256 over {t}.{body}), handle message_send and message_delivery events |
| Yapily | yapily-webhooks |
Verify Yapily webhook signatures (webhook-signature, HMAC-SHA256 hex of the raw body; not Standard Webhooks), handle single_payment.status.completed and hosted_pis.payment_status.completed.v1 events |
| Yoco | yoco-webhooks |
Verify Yoco Standard Webhooks signatures (webhook-signature, HMAC-SHA256 base64 with a whsec_ secret and 3-minute timestamp window) for the Yoco API and Checkout API, handle payment.created, payment.refunded, order.completed, and payment.succeeded events |
| YouCanBookMe | youcanbookme-webhooks |
Authenticate YouCanBookMe webhook actions (unsigned: a secret request header you choose, compared in full in constant time), handle booking_made, booking_rescheduled and booking_cancelled payloads from your template |
| YouMail | youmail-webhooks |
Authenticate YouMail Protective Services webhooks (unsigned: the whole Authorization: Bearer <token> value compared in constant time), handle CALL_EVENT, PHONE_INSIGHTS, PROVIDER_TN_REPORT_STATUS and WATCHLIST_SCORE_THRESHOLD payloads |
| Yousign | yousign-webhooks |
Verify Yousign webhook signatures (X-Yousign-Signature-256: sha256=<hex>, HMAC-SHA256 of the raw body), handle events like signature_request.done and signer.done |
| Zapier | zapier-webhooks |
Receive requests from the Webhooks by Zapier action (POST, PUT, Custom Request) — no signature; authenticate with an X-Webhook-Secret header or Basic Auth compared in constant time, and parse the user-defined Form, JSON or raw payload |
| Zendesk | zendesk-webhooks |
Verify Zendesk webhook signatures (X-Zendesk-Webhook-Signature, HMAC-SHA256 with timestamp), handle event subscriptions and trigger-based webhooks |
| Zernio | zernio-webhooks |
Verify Zernio (formerly Late) social media API webhook signatures (X-Zernio-Signature, legacy X-Late-Signature; lowercase hex HMAC-SHA256 of the raw body keyed with your own endpoint secret), handle post.published, post.failed, message.received, and account.disconnected events |
| Zero Hash | zerohash-webhooks |
Verify Zero Hash webhook signatures (x-zh-hook-signature, HMAC-SHA256 hex over payload + timestamp with replay protection; legacy x-zh-hook-signature-256), handle trade_status_changed and account_balance.changed events |
| Zift | zift-webhooks |
Receive Zift payment notifications — no HMAC signature; acknowledge each delivery by echoing {"notificationId": ...} — dispatch billing.* and processing.* events like billing.subscription-created, processing.chargeback, and processing.return |
| Zigpoll | zigpoll-webhooks |
Verify Zigpoll webhook signatures (X-Zigpoll-Signature t=<ms>,v1=<hex>, HMAC-SHA256 over {t}.{body}), handle submitted-responses and completed-survey |
| Ziina | ziina-webhooks |
Verify Ziina webhooks (X-Hmac-Signature: hex HMAC-SHA256 of the raw body), handle payment intent and refund status updates |
| ZITADEL | zitadel-webhooks |
Verify ZITADEL webhooks (ZITADEL-Signature: t=/v1= hex HMAC-SHA256 of {t}.{body}), handle Actions v2 event executions |
| Zoho Sign | zoho-sign-webhooks |
Verify Zoho Sign webhook signatures (X-ZS-WEBHOOK-SIGNATURE, HMAC-SHA256 base64), handle RequestCompleted and RequestSigningSuccess events |
| Zoom | zoom-webhooks |
Verify Zoom webhook signatures (x-zm-signature), complete the URL validation handshake, handle meeting and recording events |
| ZoomInfo | zoominfo-webhooks |
Verify ZoomInfo webhooks — no signature; compare the x-zoominfo-token verification token in constant time, accept the pre-token Validate request, handle Contact and Company update events |
| Zoop | zoop-webhooks |
Authenticate Zoop webhooks (unsigned: the authorization value sent verbatim in Authorization, compared in constant time), handle transaction, seller and ping events |
| Zuora | zuora-webhooks |
Authenticate Zuora callout notifications (unsigned HTTP Basic auth with Enable Preemptive Authentication, compared in constant time), handle the callout bodies your templates send |
Framework-agnostic best practices for webhook handling, applicable across any webhook integration.
| Skill | What It Does |
|---|---|
webhook-handler-patterns |
Implement webhook idempotency, error handling, retry logic, async processing |
Skills for webhook infrastructure products — routing, queuing, delivery, and observability.
| Product | Skill | What It Does |
|---|---|---|
| Hookdeck Event Gateway | hookdeck-event-gateway |
Webhook infrastructure that replaces your queue — guaranteed delivery, retries, rate limiting, replay, observability |
| Hookdeck Event Gateway (receiver) | hookdeck-event-gateway-webhooks |
Verify x-hookdeck-signature and handle webhooks forwarded by the Hookdeck Event Gateway |
| Hookdeck Outpost | outpost |
Send webhooks and events to user-preferred destinations (HTTP, SQS, RabbitMQ, Pub/Sub, EventBridge, Kafka) |
Meta-skills that evaluate the developer experience of platforms sending outbound webhooks and event destinations, rather than helping you receive or send them. "Event destinations" covers the broader case where a platform delivers events to user-chosen destinations beyond HTTP (SQS, Pub/Sub, RabbitMQ, EventBridge, Kafka), not only webhooks.
| Skill | What It Does |
|---|---|
webhook-dx-audit |
Audit a platform's outbound webhook and event destinations DX (signing, retries, event catalog, observability, local dev, agent readiness) and produce a scored review with prioritized recommendations |
# List available webhook skills
npx skills add hookdeck/webhook-skills --list
# Install Stripe webhook skill
npx skills add hookdeck/webhook-skills --skill stripe-webhooks
# Install multiple webhook skills
npx skills add hookdeck/webhook-skills --skill stripe-webhooks --skill shopify-webhooksClaude Code distributes this repo as a plugin marketplace. Add the marketplace once, then install either a single provider skill or the bundle of all 40 skills.
# Add this marketplace
/plugin marketplace add hookdeck/webhook-skills
# Install one provider skill (each is ~200 KB)
/plugin install stripe-webhooks@webhook-skills
# Or install all 40 webhook skills as one bundle (~3 MB)
/plugin install webhook-skills@webhook-skills
Plugin skills are namespaced with their plugin name, so the bundle exposes skills as webhook-skills:stripe-webhooks, webhook-skills:shopify-webhooks, etc., while a granular install exposes the same skill as stripe-webhooks:stripe-webhooks.
To receive webhooks on localhost during development, run Hookdeck CLI via npx — no install required:
# Start local webhook tunnel (no account required)
npx hookdeck-cli listen 3000 stripe --path /webhooks/stripeThis provides a public URL that forwards webhook events to your local server, plus a web UI for inspecting and replaying webhook requests.
If an agent receives a checkout.session.completed event from Stripe, the stripe-webhooks skill can:
- Verify the webhook signature using Stripe's signing secret
- Parse the event payload to extract checkout session data
- Return a normalized event object for further processing
After installing the skill, ask your AI assistant:
"Help me set up Stripe webhook handling in my Express app"
The agent will:
- Read
stripe-webhooks/SKILL.mdto understand webhook verification - Reference
stripe-webhooks/references/verification.mdfor signature verification details - Copy code from
stripe-webhooks/examples/express/as a starting point - Suggest
npx hookdeck-cli listen 3000 stripe --path /webhooks/stripefor local webhook testing
If an agent needs to verify GitHub webhook authenticity, the github-webhooks skill can:
- Extract the signature header (
X-Hub-Signature-256) - Compute HMAC-SHA256 of the raw request body
- Compare signatures using timing-safe comparison
Ask your AI assistant:
"How do I verify GitHub webhook signatures in Next.js?"
Each webhook skill follows a consistent structure:
skills/{provider}-webhooks/
├── SKILL.md # Entry point — webhook overview, when to use
├── references/ # Documentation loaded on-demand
│ ├── overview.md # What webhooks are available, common events
│ ├── setup.md # Provider dashboard configuration
│ └── verification.md # Webhook signature verification details
└── examples/ # Runnable webhook handler examples
├── express/ # Express.js webhook handler
├── nextjs/ # Next.js API route webhook handler
└── fastapi/ # FastAPI webhook handler
Examples are complete, runnable webhook handlers following PostHog's approach — minimal code that demonstrates webhook signature verification and event handling.
We welcome contributions! The recommended way to add new provider webhook skills is using our AI-powered generator:
# One-time setup
cd scripts/skill-generator && npm install && cd ../..
# Generate a webhook skill (with documentation URL for best results)
./scripts/generate-skills.sh generate \
"twilio=https://www.twilio.com/docs/usage/webhooks" \
--create-prThe generator researches the provider's webhook documentation, generates signature verification code and tests for Express/Next.js/FastAPI, validates accuracy, and creates a PR — all automatically.
See CONTRIBUTING.md for the complete guide, including:
- Providing multiple documentation URLs for better webhook skill generation
- Using YAML configs for batch webhook skill generation
- Resuming failed generations with the
reviewcommand - Updating existing webhook skills
- Manual contribution guidelines
- Agent Skills Specification — The open standard for AI agent skills
- Skills Directory — Discover and install agent skills
- Hookdeck CLI — Local webhook tunnel and debugging
- Hookdeck Documentation — Webhook infrastructure platform
MIT