Agent skill · software engineering · jeremylongshore
flexport-webhooks-events
Verify Flexport webhook signatures on the raw request body and reconcile real event types. Use when building a receiver, rotating webhook secrets, processing shipment or purchase-order events, or recovering delivery gaps. Trigger with: "verify Flexport webhook", "handle Flexport event", "reconcile webhook gap".
Why this skill is useful
Provides specific implementation details for handling Flexport webhook events that the AI wouldn't reliably generate on its own.
What it needs
Requires npm installed locally. Requires flexport account access. About 2k tokens when loaded. Last updated 2026-08-07. 2,604 stars on the source repository.
What this skill does
Flexport Webhook Integrity and Reconciliation Overview Authenticate before parsing. Flexport documents both SHA-1 and SHA-256 signatures, with SHA-256 recommended in X-Hub-Signature-256; compare against the raw UTF-8 body and treat webhook delivery as a notification that may require API reconciliation. Prerequisites Unique receiver URL and high-entropy webhook secret Framework support for raw request bytes before JSON parsing Allowlisted slash/hash event types and idempotency store Instructions Step 1: Register deliberately Configure the callback and secret in Flexport account Settings. Record the intended event types and owner. Step 2: Capture raw bytes Read the exact request body before middleware transforms encoding or JSON layout. Step 3: Verify SHA-256 Compute HMAC-SHA256 with the stored secret, parse X-Hub-Signature-256, reject malformed or unequal-length inputs, and use constant-time comparison. Step 4: Acknowledge quickly After authentication and durable enqueue, return HTTP 200 promptly. Keep business processing out of the request path. Step 5: Deduplicate and route Use provider event identity when present or a stable payload digest. Allow only documented names such as /shipment#created or /purchaseorder#updated. Step 6: Reconcile gaps Use authorized REST /events or resource reads when evidence indicates a delivery gap; do not invent a webhook replay endpoint or retry schedule. Authentication REST calls authenticate with a cached OAuth 2.0 client-credentials Bearer token using audience https://api.flexport.com, or an explicitly accepted broad API key. Use distinct credentials per workload and never log credentials or tokens. MCP calls use the authenticated connection to https://mcp.flexport.com/mcp and remain subject to each tool's documented account permissions. Tool Discipline Use Read and Grep for discovery and evidence. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills jeremylongshore/flexport-webhooks-events