Agent skill · marketing growth · jeremylongshore
exa-webhooks-events
Receive Exa Monitor events through verified signatures, replay resistance, deduplication, and fast acknowledgment. Use when operating or reviewing this Exa boundary. Trigger with "Exa webhooks events", "review Exa webhooks events", or "fix Exa webhooks events".
Why this skill is useful
Adds specific event-driven integration patterns and executable code for building automated content monitoring with Exa that the AI wouldn't reliably generate on its own.
What it needs
Requires bullmq, exa-js, redis installed locally. Requires exa account access. About 3k tokens when loaded. Last updated 2026-08-07. 2,604 stars on the source repository.
What this skill does
Exa Monitor Webhook Processing Overview Receive Exa Monitor events through verified signatures, replay resistance, deduplication, and fast acknowledgment. Treat credentials, queries, retrieved content, generated output, spend, and destructive state as separately governed boundaries. Prerequisites The target repository, environment, Exa team, product surface, and accountable owner. The workload's data classification, latency and freshness promise, cost ceiling, and retention policy. Current first-party documentation plus credentials only for a narrowly approved live check. Current Contract Monitors schedule recurring searches, deduplicate prior results, and deliver to an HTTPS public webhook. The one-time webhookSecret is returned only when a Monitor is created. Exa-Signature carries timestamp and v1 values for HMAC-SHA256 verification over the signed payload; redirects are not followed. Authentication For normal REST work, inject EXAAPIKEY from an approved server-side secret manager and send it only as Authorization: Bearer to the configured first-party Exa API host. Team Management service keys, hosted MCP OAuth or enterprise managed authorization, and payment-protocol calls are separate trust models. Never print, commit, place in a URL, or expose a credential to an untrusted client. Instructions 1. Create or rotate a Monitor only with an approved query, schedule, destination, and budget. 2. Store the one-time webhook secret immediately in the receiver secret store. 3. Verify the raw body timestamp and HMAC using constant-time comparison before parsing. 4. Reject stale, malformed, unsigned, redirected, or unrecognized deliveries. 5. Deduplicate on stable event and run identifiers, acknowledge quickly, and enqueue work. 6. Reconcile webhook processing with the Monitor run API and retain content-free evidence. Tool Discipline Use Read, Glob, and Grep to inspect repository code, configuration, fixtures, and evidence. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills jeremylongshore/exa-webhooks-events