Agent skill · software engineering · jeremylongshore
attio-webhooks-events
Build and operate an Attio webhook receiver with raw-body HMAC verification, fast acknowledgement, durable queues, idempotent processing, retry awareness, and reconciliation. Use when implementing or repairing Attio event delivery. Trigger with "Attio webhooks", "Attio events", or "verify Attio signature".
Why this skill is useful
Adds executable scripts for Attio webhook registration, signature verification, and event handling that aren't in public docs.
What it needs
Requires express installed locally. Requires attio account access. About 2k tokens when loaded. Last updated 2026-08-07. 2,604 stars on the source repository.
What this skill does
Attio Webhook Receiver Overview This skill implements the complete event-delivery boundary: authenticate the exact payload, acknowledge within Attio's delivery window, process at least once safely, and reconcile missed or delayed effects. Prerequisites Public HTTPS receiver and approved webhook secret storage Required event types and downstream ownership Durable queue and idempotency store Replay, dead-letter, and reconciliation procedures Tool Discipline Use Read, Glob, and Grep to inspect raw-body middleware, route handling, queues, and deduplication. Use WebFetch only for current official Attio webhook documentation. Use Write or Edit after the event contract and failure policy are confirmed. Current Contract Read Attio-Signature; legacy deliveries may also expose X-Attio-Signature. Compute SHA-256 HMAC over the exact raw UTF-8 request body using the webhook secret and compare hexadecimal signatures safely. Return a 2xx quickly after validation and durable acceptance; Attio documents a 5-second timeout. Delivery is at least once. Use Idempotency-Key for deduplication. Attio documents up to 10 retries over roughly three days and a delivery limit of 25 requests per second per target URL; reverify before rollout. Authentication Store the webhook secret server-side. Verify the signature before JSON parsing, logging, queueing, or any state change, and support controlled secret rotation. Instructions 1. Capture the raw request bytes before body-parsing middleware transforms them. 2. Read the supported signature header, decode the expected hex, and reject malformed or unequal-length values. 3. Compute raw-body HMAC and use a timing-safe equal-length comparison. 4. Validate the event envelope and reserve Idempotency-Key transactionally. 5. Persist the event to a durable queue, then return 2xx within the timeout. 6. Process idempotently with bounded concurrency, explicit dead-letter handling, and redacted telemetry. 7. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills jeremylongshore/attio-webhooks-events