Validate Cursor Cloud Agent webhook signatures with HMAC-SHA256.
npx skills add https://github.com/hookdeck/webhook-skills --skill cursor-webhooks
Please help me install this Agent Skill. Skill: cursor-webhooks Source: https://github.com/hookdeck/webhook-skills/tree/main/skills/cursor-webhooks Command: npx skills add https://github.com/hookdeck/webhook-skills --skill cursor-webhooks
Cursor webhooks provide a way for your app to receive real-time agent status changes from Cursor Cloud Agent and verify that callbacks are authentic, preventing spoofed requests and data leakage.
Set up a Cursor webhook endpoint and verify signatures using the sample payloads in the examples folder.
High-intent search queries and answers about installing and using this skill.
To verify Cursor Cloud Agent webhook signatures, validate the X-Webhook-Signature header using HMAC-SHA256 with your CURSOR_WEBHOOK_SECRET against the raw request body. This ensures authentic event delivery and prevents spoofed requests.
Yes, you can process Cursor webhook statusChange events in Next.js and Express. The Skill provides framework-specific samples to handle FINISHED and ERROR events, allowing you to access payload data like id, timestamp, source, and target.
Yes, you need the raw request body for Cursor webhook signature validation. Using the parsed or modified body will cause the HMAC-SHA256 signature verification to fail, so you must access the unaltered raw stream to compute the hash.
The best way to test Cursor webhooks locally is by using Hookdeck CLI tunnels or local dev servers. This simulates real statusChange events, allowing you to debug your signature verification and event handling logic before deploying.
You must configure the CURSOR_WEBHOOK_SECRET environment variable to receive and verify Cursor webhooks. This secret is essential for computing the HMAC-SHA256 hash to validate the X-Webhook-Signature header on incoming statusChange events.
curvenoteReceive and process inbound emails via Resend webhooks with signature verification.
AdemKaoSend real-time Telegram or desktop notifications for task events.
commercengineValidate signatures, route Commerce Engine webhook events by type, and queue asynchronous work.
schuettcMigrate Express routes to AWS Lambda functions behind API Gateway.
