flask

Verify HMAC-SHA256 signatures and dispatch Flask webhook events by type.

1|Updated Mar 11, 2026
One-click install
npx skills add https://github.com/antonyfmunoz/OS --skill flask-antonyfmunoz
Or copy as Structured Prompt for Agent
Please help me install this Agent Skill.
Skill: flask
Source: https://github.com/antonyfmunoz/OS/tree/main/skills/tools/flask
Command: npx skills add https://github.com/antonyfmunoz/OS --skill flask-antonyfmunoz

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

Flask-based webhook receivers help you reliably accept signed inbound POST requests and transform them into deterministic downstream actions without building a full API server.

Core Features & Use Cases

  • Webhook endpoints for inbound events: Receive provider payloads (e.g., Calendly) and route by event type such as invitee.created and invitee.canceled.
  • HMAC signature verification: Validate requests using raw request bytes to prevent tampering and avoid JSON re-serialization mismatches.
  • Operational endpoints and event dispatching: Provide a lightweight /health check and trigger downstream EOS modules and event propagation.

Quick Start

Ask the AI to help you implement a Flask POST route for a new webhook endpoint that verifies the provider signature using request.data, returns 401 on mismatch, and dispatches to the correct handler based on the event type.

Frequently Asked Questions about flask

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I validate HMAC-SHA256 signatures for incoming webhooks in Flask?

Validate HMAC-SHA256 webhook signatures by computing the hash over raw request bytes via request.data and comparing against the provider signature using hmac.compare_digest to prevent tampering.

Why does my Flask webhook signature verification fail when parsing JSON?

Flask webhook signature verification fails on JSON re-serialization mismatches because the computed HMAC no longer matches the raw payload sent by the provider. Use request.data to access the exact raw bytes for accurate signature validation.

How do I route incoming webhook events to different handlers in a Flask application?

Route webhook events in a Flask application by parsing the event type from the payload and dispatching to specific downstream handlers, allowing your service to trigger appropriate business logic for distinct event types like invitee.created.

Can I use Flask to build a lightweight WSGI webhook receiver without a full API server?

Yes, you can use Flask to build a lightweight WSGI webhook receiver by implementing POST routes for signed payloads, adding a /health check, and delegating downstream business logic to application modules without building a full API server.

What is the best way to return HTTP status codes for invalid webhook requests in Flask?

Return HTTP 401 status codes for invalid webhook requests in Flask when signature verification fails, ensuring only authenticated inbound POST requests trigger downstream event dispatching and business logic execution.