gitlab-webhooks

Receive and verify GitLab webhooks with token authentication.

79|11|Updated Jan 30, 2026

Search Tags:#Next.js #FastAPI #webhook #Express #GitLab #event-handling #token-verification

One-click install

npx skills add https://github.com/hookdeck/webhook-skills --skill gitlab-webhooks

Or copy as Structured Prompt for Agent▼

Please help me install this Agent Skill.
Skill: gitlab-webhooks
Source: https://github.com/hookdeck/webhook-skills/tree/main/skills/gitlab-webhooks
Command: npx skills add https://github.com/hookdeck/webhook-skills --skill gitlab-webhooks

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

GitLab webhooks are a reliable way to trigger CI/CD and automation, but receiving, authenticating, and handling them consistently across runtimes can be tricky. This Skill provides a battle-tested pattern to securely accept GitLab webhook deliveries and route events to your handlers.

Core Features & Use Cases

Token-based verification using the X-Gitlab-Token header to authenticate requests
Comprehensive event handling for push, tag_push, merge_request, issue, work_item, note, pipeline, build, wiki_page, deployment, release
Ready-to-run examples and hooks for Express, Next.js, and FastAPI to jump-start webhook receivers

Quick Start

Start a minimal webhook receiver using the included patterns and point GitLab to your endpoint
Set GITLAB_WEBHOOK_TOKEN in your environment to a strong secret
Send test webhooks from GitLab and observe structured logs and consistent responses

Frequently Asked Questions about gitlab-webhooks

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I verify GitLab webhooks in my FastAPI or Express application?▼

To verify GitLab webhooks, authenticate incoming requests using the X-Gitlab-Token header and apply timing-safe token verification against your secret environment variable. This ensures only valid GitLab deliveries trigger your event handlers.

What is the best way to handle GitLab push and merge_request events in Next.js?▼

Handling GitLab push and merge_request events in Next.js requires parsing the JSON payload and routing the event object to specific handlers. Using a consistent webhook receiver pattern ensures safe event processing across different event types.

Does this webhook receiver pattern support GitLab pipeline and deployment events?▼

Yes, the webhook receiver pattern supports GitLab pipeline and deployment events, alongside push, tag_push, merge_request, issue, work_item, note, build, wiki_page, and release events for comprehensive CI/CD automation.

Why should I use timing-safe token verification for GitLab webhooks?▼

Timing-safe token verification prevents timing attacks when authenticating GitLab webhooks. Unlike simple string comparison, it checks the X-Gitlab-Token header in constant time, stopping attackers from guessing your secret through response delays.

Can I use the same GitLab webhook handler across Express, Next.js, and FastAPI?▼

Yes, you can implement consistent GitLab webhook handling across Express, Next.js, and FastAPI. The provided patterns apply token verification and JSON payload parsing uniformly, allowing you to route events to handlers regardless of the runtime.

What environment variable do I need to set up before receiving GitLab webhooks?▼

You need to set the GITLAB_WEBHOOK_TOKEN environment variable to a strong secret before receiving GitLab webhooks. This token authenticates incoming requests by matching it against the X-Gitlab-Token header sent by GitLab.