Agent skill · security · jeremylongshore
intercom-security-basics
Apply Intercom security best practices for tokens, webhook verification,
Why this skill is useful
Provides specific security practices and code snippets for securing Intercom tokens and webhooks that the AI wouldn't reliably generate on its own.
What it needs
Requires intercom account access. About 3k tokens when loaded. Last updated 2026-08-07. 2,604 stars on the source repository.
What this skill does
Intercom Security Basics Overview Security best practices for Intercom access tokens, webhook signature verification, Identity Verification (HMAC), and least-privilege OAuth scopes. The full code for each control lives in references/ so this file stays a fast, high-level checklist you can follow end-to-end, then drill into for depth: Implementation reference — complete webhook, identity, rotation, and scope code. Worked examples — four end-to-end walkthroughs. Prerequisites Intercom access token or OAuth credentials Understanding of HMAC cryptographic signatures Access to Intercom Developer Hub Instructions Step 1: Secure Token Storage Store every secret in .env (or a secret manager) and never commit it. Then scan history for anything already leaked — use Grep (or the shell) to search committed content for token markers: Step 2: Webhook Signature Verification (X-Hub-Signature) Intercom signs webhook notifications with HMAC-SHA1 using X-Hub-Signature. Verify it on every incoming webhook against the raw request body, using a timing-safe comparison, and reject mismatches with 401: Full Express handler: implementation.md — Webhook Signature Verification. Step 3: Identity Verification (User Hash) Identity Verification blocks impersonation by requiring an HMAC-SHA256 of the user's identifier, generated server-side only: Return this userhash alongside appid and userid for Messenger boot. Full code: implementation.md — Identity Verification. Step 4: Least-Privilege OAuth Scopes Only request the scopes your app actually uses — excess scopes widen the blast radius of a leaked token. The full use-case → scope mapping is in implementation.md — Least-Privilege OAuth Scopes. For example, a read-only contacts integration needs just Read contacts, not full CRM read/write. Step 5: Token Rotation Procedure Rotate by adding the new token to your secret manager and deploying before revoking the old one, so no window exists without a live token. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills jeremylongshore/intercom-security-basics