Agent skill · marketing growth · jeremylongshore
clickup-webhooks-events
Register, verify, process, monitor, and reconcile ClickUp webhooks with raw-body HMAC, durable idempotency, fast acknowledgment, and gap recovery. Use when building event-driven ClickUp integrations. Trigger with "ClickUp webhook", "verify X-Signature", or "ClickUp events".
Why this skill is useful
Provides specific API commands and event handling patterns for ClickUp webhooks that the AI wouldn't reliably generate on its own.
What it needs
Requires express installed locally. Requires clickup account access. About 2k tokens when loaded. Last updated 2026-08-07. 2,604 stars on the source repository.
What this skill does
ClickUp Signed Webhook Operations Overview Treat webhooks as signed, user-owned change signals that need durable processing and reconciliation. Assume delivery can duplicate, arrive late, or stop after ownership changes. Prerequisites A public HTTPS endpoint capable of retaining raw request bytes A secret manager, durable queue/idempotency store, and Workspace allow-list An authorized user owner for the webhook plus monitoring and reconciliation Tool Discipline Use Read, Glob, and Grep to inspect the repository, adapters, configuration names, tests, and evidence. Use WebFetch only for current official ClickUp documentation. Use Write or Edit after confirming the target file, Workspace boundary, and requested mode. Current Contract Webhook creation returns a unique secret; verify raw-body HMAC-SHA256 against hexadecimal X-Signature. Registrations are tied to the creating user and can stop triggering when that user is disabled or loses hierarchy access. Use webhookid:historyitemid as the documented idempotency key when a history item exists; handle events without one deliberately. Responses over seven seconds or unsuccessful responses are failures; ClickUp attempts delivery up to five times, does not resend the failed event later, suspends at failcount=100, and a 401 suspends immediately. Authentication Use a personal token only for accountable individual/testing work or OAuth Authorization Code for a user-facing integration. Inject the token server-side through a governed secret reference, send it in Authorization, verify authorized Workspace IDs, and never print the token, OAuth client secret, or webhook secret. Instructions 1. Choose the narrowest location and explicit event set; inventory duplicate registrations before creation. 2. Register only after endpoint ownership, HTTPS, secret storage, and rollback approval are confirmed. 3. Capture raw bytes, look up the per-webhook secret, verify HMAC in constant time, then parse/validate JSON. 4. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills jeremylongshore/clickup-webhooks-events