Agent skill · software engineering · jeremylongshore
salesloft-webhooks-events
Verify and process Salesloft webhooks using exact raw-body SHA-1 HMAC, callback-token validation, event routing, durable deduplication, and reconciliation. Use when building or auditing a webhook receiver. Trigger with "Salesloft webhook", "Salesloft signature", or "Salesloft event handler".
Why this skill is useful
Adds a complete implementation for handling SalesLoft webhooks with signature verification and event routing, including executable code snippets.
What it needs
Requires crypto, express installed locally. Requires salesloft account access. About 2k tokens when loaded. Last updated 2026-08-07. 2,604 stars on the source repository.
What this skill does
Salesloft Verified Webhook Processing Overview This skill accepts a delivery only after authenticating its exact bytes and subscription secret. It makes side effects idempotent even though the general delivery contract does not expose a timestamp replay header. Prerequisites Approved HTTPS callback URL and event type Webhook subscription with a high-entropy callback token Raw-body access before JSON parsing Durable deduplication store and reconciliation owner Tool Discipline Use Read, Glob, and Grep to inspect body parsing, signature comparison, queues, and side effects. Use WebFetch only for current official Salesloft webhook documentation. Use Write or Edit after the handler boundary is confirmed. Current Contract x-salesloft-event identifies the delivered event type. x-salesloft-signature is the hexadecimal SHA-1 HMAC of the exact response/request body using callbacktoken as the key. The callback token is also included in each event payload and should be validated. Failed deliveries are retried three additional times, 15 seconds apart. Subscription scopes vary by event type and must be checked in the current event table. Authentication Protect the callback token as a secret. Compute the expected HMAC from the exact raw body, decode hex safely, require equal lengths, and use constant-time comparison before parsing or queuing. Instructions 1. Capture raw bytes and required headers before any middleware transforms the body. 2. Reject missing, malformed, unequal-length, or non-matching signatures. 3. Parse JSON only after signature success and validate the callback token and expected event type. 4. Derive a stable deduplication key from event type plus canonical business identifiers and payload digest. 5. Persist receipt and dedup state before acknowledging or dispatching side effects. 6. Process asynchronously with bounded retries and reconcile missed changes through API reads. 7. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills jeremylongshore/salesloft-webhooks-events