Agent skill · software engineering · jeremylongshore
klaviyo-webhooks-events
Implement Klaviyo webhooks with HMAC-SHA256 signature verification and
Why this skill is useful
Adds a complete implementation guide for Klaviyo webhooks with executable code for signature verification and event handling.
What it needs
Requires express, redis installed locally. Requires klaviyo account access. About 3k tokens when loaded. Last updated 2026-08-07. 2,604 stars on the source repository.
What this skill does
Klaviyo Webhooks & Events Overview Set up Klaviyo webhooks with HMAC-SHA256 signature verification, event routing, idempotency handling, and the Webhooks API for programmatic subscription management. This skill covers the full endpoint lifecycle in six steps: create a webhook subscription via the API, verify each request's signature, receive events in an Express handler, route them to per-topic handlers, deduplicate with Redis, and manage subscriptions. The high-level flow and the security-critical signature check live here; the complete step-by-step source is in references/implementation.md and worked scenarios are in references/examples.md. Prerequisites Klaviyo account with webhooks enabled HTTPS endpoint accessible from internet API key with scopes: webhooks:read, webhooks:write Redis or database for idempotency (recommended) Klaviyo Webhook Architecture Klaviyo webhooks fire when specific topics occur in your account. Each webhook is signed with a secret key using HMAC-SHA256, sent in the webhook-signature header. Topic Category Example Topics --------------- --------------- Profile profile.created, profile.updated, profile.deleted List list.member.added, list.member.removed Segment segment.member.added, segment.member.removed Campaign campaign.sent, campaign.delivered Flow flow.triggered, flow.message.sent Event Custom metric events Instructions Follow these six steps in order. Each is fully sourced in references/implementation.md; the security-critical signature check is inlined below because getting it wrong is the most common failure. 1. Create a webhook subscription — call webhooksApi.createWebhook with the target endpointUrl and webhookTopics, then save the signing secret from the response as KLAVIYOWEBHOOKSIGNINGSECRET. 2. Verify the signature — recompute the HMAC-SHA256 over the raw request body and compare with a timing-safe check (skeleton below). 3. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills jeremylongshore/klaviyo-webhooks-events