Agent skill · software engineering · jeremylongshore
ideogram-webhooks-events
Verify and reconcile Ideogram async webhooks with Ed25519 signatures, replay controls, deduplication, and polling fallback. Use when implementing or auditing an event receiver. Trigger with "verify an Ideogram webhook", "build Ideogram async callbacks", or "debug duplicate Ideogram events".
Why this skill is useful
Adds executable scripts for async job processing and callback handling with Ideogram's API that aren't in public docs.
What it needs
Requires redis installed locally. Requires ideogram account access. About 2k tokens when loaded. Last updated 2026-08-07. 2,604 stars on the source repository.
What this skill does
Ideogram Webhook Verification and Reconciliation Overview Accept Ideogram asynchronous completion only after cryptographic verification and idempotent reconciliation. Use the raw request body, bind all signed headers, acknowledge quickly, and retain polling as a recovery path because delivery is not guaranteed. Prerequisites A public HTTPS receiver, raw-body access, durable event store, queue, and clock. The submitted generationid, destination object policy, and polling reconciler. Local Ed25519 fixtures for valid, invalid, stale, duplicate, and rotated-key deliveries. Current Contract Async requests can include a webhook URL and return generationid. Ideogram signs callbacks with Ed25519 and publishes keys at https://api.ideogram.ai/v1/.well-known/jwks.json. Signed headers identify generation, user, timestamp, key, and signature. Deliveries may duplicate, retries are limited, and polling remains necessary. Authentication Webhook trust comes from signature verification, not a shared API key in the callback. Normal polling uses server-side IDEOGRAMAPIKEY in the Api-Key header; never expose it to the receiver request. Instructions 1. Capture the raw body bytes and required generation-ID, user-ID, timestamp, key-ID, and signature headers before JSON parsing. 2. Compute SHA-256 over the raw body and construct the signed message as generation ID, newline, user ID, newline, timestamp, newline, then the lowercase body hash. 3. Resolve the key ID from the JWKS cache and verify the lowercase-hex Ed25519 signature. 4. Enforce a bounded timestamp window and bind the callback to a known submitted generation and expected application tenant. 5. Persist a deduplication record keyed by generation and delivery evidence, return 2xx quickly, and enqueue processing. 6. Validate safety, download approved output, persist it, and transition state idempotently. 7. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills jeremylongshore/ideogram-webhooks-events