Agent skill · software engineering · jeremylongshore
persona-webhooks-events
Verify, persist, deduplicate, order, and reconcile Persona webhook events from exact raw bytes. Use when implementing webhook consumers. Trigger with: "handle Persona webhook", "verify Persona-Signature", "dedupe Persona events".
Why this skill is useful
Adds a complete webhook handling implementation with HMAC verification and event processing scripts for Persona identity verification.
What it needs
Requires crypto, express installed locally. Requires persona account access. About 3k tokens when loaded. Last updated 2026-08-07. 2,604 stars on the source repository.
What this skill does
Authentic and Idempotent Persona Event Intake Overview A webhook is an untrusted delivery until its signature passes. Persona may deliver duplicates or events out of order, so authenticity, durable receipt, idempotency, event-time ordering, and resource reconciliation are distinct steps. Prerequisites HTTPS endpoint retaining exact raw request bytes Persona webhook secret with rotation metadata Durable unique event store and reconciliation worker Instructions Step 1: Capture before parsing Read the exact raw bytes and Persona-Signature header. Enforce size, method, content-type, and timestamp policy before business work. Step 2: Parse signature candidates Extract t and every v1 value. Reject malformed or missing components; retain only redacted diagnostic metadata. Step 3: Compute and compare Compute HMAC-SHA256 with the webhook secret over t + '.' + rawBody. Compare against every v1 candidate in constant time to support rotation. Step 4: Acknowledge durable receipt After authenticity, insert the event ID and raw-body hash under a uniqueness constraint, then acknowledge quickly. Duplicate inserts are successful no-ops. Step 5: Process in provider time Route by event type while tolerating unknown types. Use data.attributes.created-at, not arrival order, to guard state transitions. Step 6: Reconcile before consequential action For approval, rejection, payout, or access changes, read the current Persona resource and apply the versioned domain policy. Authentication Webhook authentication uses the endpoint signing secret and the Persona-Signature HMAC protocol; it does not use the REST bearer key. Resource reconciliation uses the environment bearer key separately. Tool Discipline Use Read and Grep to inspect application configuration, provider documentation, fixtures, schemas, tests, and redacted operational evidence before proposing a change. Use Write or Edit only for an approved implementation, configuration, test, runbook, or redacted receipt. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills jeremylongshore/persona-webhooks-events