Agent skill · software engineering · jeremylongshore
creating-webhook-handlers
Create webhook endpoints with signature verification, retry logic, and
Why this skill is useful
Adds executable scripts for webhook handling with signature verification and idempotency that aren't in public docs.
What it needs
Requires ngrok, redis installed locally. About 3k tokens when loaded. Last updated 2026-08-07. 2,604 stars on the source repository.
What this skill does
Creating Webhook Handlers Overview Create secure webhook receiver endpoints with HMAC signature verification, idempotent event processing, and automatic retry handling. Support ingestion from providers like Stripe, GitHub, Twilio, and Slack with provider-specific signature validation schemes and payload parsing. Prerequisites Web framework with raw body access (Express with express.raw(), FastAPI with Request.body()) Webhook provider credentials: signing secret or shared secret key Persistent storage for idempotency tracking (Redis or database table for processed event IDs) Queue system for async processing (optional: Bull, Celery, SQS) ngrok or similar tunnel for local development testing Instructions 1. Examine existing route definitions and middleware using Grep and Read to identify where webhook endpoints integrate into the application. 2. Create a dedicated webhook route (e.g., POST /webhooks/:provider) that captures the raw request body before any JSON parsing middleware runs. 3. Implement HMAC-SHA256 signature verification by computing HMAC(rawbody, signingsecret) and comparing against the provider's signature header (X-Hub-Signature-256, Stripe-Signature, X-Twilio-Signature). 4. Add idempotency protection by storing processed event IDs (e.g., evtxxx) in Redis or a database table, rejecting duplicates with 200 OK to prevent provider retries. 5. Parse the event type from the payload (event.type, action, EventType) and route to the appropriate handler function using a dispatch map. 6. Respond with 200 OK immediately, then enqueue the event payload for asynchronous processing to avoid webhook timeout failures. 7. Implement dead-letter handling for events that fail processing after maximum retry attempts, logging the full payload for manual inspection. 8. Write tests that replay recorded webhook payloads with valid and tampered signatures to verify acceptance and rejection behavior. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills jeremylongshore/creating-webhook-handlers--a7dba5