Agent skill · software engineering · jeremylongshore
linear-webhooks-events
Implement Linear webhook verification, fast acknowledgement, deduplication, queued processing, and reconciliation. Use when receiving issue, project, cycle, customer, user, or OAuth-app events. Trigger with "handle Linear webhooks", "verify Linear signature", or "process Linear events".
Why this skill is useful
Adds specific implementation details and event handling patterns for Linear webhooks that the AI wouldn't reliably generate on its own.
What it needs
Requires ngrok installed locally. Requires linear account access. About 3k tokens when loaded. Last updated 2026-08-07. 2,604 stars on the source repository.
What this skill does
Linear Verified Webhook Processing Overview Build an ingress path that proves authenticity on raw bytes, acknowledges quickly, and makes downstream processing replay-safe. Prerequisites The target repository, Linear workspace, environment, and accountable owner Current security, privacy, compliance, capacity, and change-control requirements An approved Linear credential only when a bounded live verification is necessary Tool Discipline Use Read, Glob, and Grep to inspect code, configuration, and evidence. Use WebFetch only for current first-party Linear documentation and package metadata. Use Write or Edit only for requested implementation with known target files. Never write credentials, customer content, unrestricted environment output, or unredacted GraphQL variables. Current Contract The endpoint must be public HTTPS and return HTTP 200 within five seconds; failures retry after one minute, one hour, and six hours, up to three retries. Linear-Signature is the hex HMAC-SHA256 of the exact raw body; Linear-Delivery is the unique delivery UUID and Linear-Timestamp is epoch milliseconds. Only workspace admins or OAuth applications with admin scope can create or read webhooks. The official SDK provides LinearWebhookClient, including raw-body signature verification and framework handlers. Authentication Use a personal API key only for owner-controlled scripts, OAuth with PKCE for user-delegated applications, or an enabled client-credentials grant for approved automation. Personal keys use Authorization: <APIKEY>; OAuth tokens use Authorization: Bearer <ACCESSTOKEN>. Store credentials server-side in an approved secret manager. Treat app approval, team access, scope changes, credential creation, rotation, revocation, and production access as owner-approved actions. Instructions 1. Select explicit resource types and team/all-public-team scope, and identify the webhook/admin owner. 2. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills jeremylongshore/linear-webhooks-events--9760f2