hookdeck-event-gateway-webhooks

To verify Hookdeck webhooks, validate the x-hookdeck-signature header using HMAC-SHA-256 signature verification with base64 encoding. You must access the raw body of the incoming request to properly compute and compare the hash.

Webhook signature verification in Next.js App Router requires accessing the raw request body before parsing. The skill provides framework-ready handlers to validate the Hookdeck signature header and securely route events to your application logic.

Yes, you can use Express and FastAPI to process webhooks forwarded through Hookdeck. The skill includes framework-ready example handlers for both platforms to help you quickly implement signature validation and event routing.

Webhook signature verification fails when parsing JSON bodies because the HMAC-SHA-256 hash computation requires the exact raw-body bytes. Modifying the body structure or whitespace during JSON parsing invalidates the signature comparison.

To debug Hookdeck webhook events and signature failures, use the Hookdeck headers attached to the forwarded request. These headers provide visibility into the event flow and help diagnose mismatches in your signature verification logic.

Yes, you need to set the HOOKDECK_WEBHOOK_SECRET in your environment variables to validate the x-hookdeck-signature header. This secret is used as the cryptographic key for generating the HMAC-SHA-256 hash.