Verify SHA-1 HMAC signatures on incoming Vercel webhook payloads.
npx skills add https://github.com/hookdeck/webhook-skills --skill vercel-webhooks
Please help me install this Agent Skill. Skill: vercel-webhooks Source: https://github.com/hookdeck/webhook-skills/tree/main/skills/vercel-webhooks Command: npx skills add https://github.com/hookdeck/webhook-skills --skill vercel-webhooks
This Skill enables your applications to securely receive and verify Vercel webhooks by validating the x-vercel-signature header against the raw request body using HMAC-SHA1.
Set up a webhook endpoint (e.g., /webhooks/vercel) that reads the raw JSON body, verifies the signature using VERCEL_WEBHOOK_SECRET, and processes event payloads. Use the included examples in this skill for Express, Next.js, and FastAPI to validate your setup.
High-intent search queries and answers about installing and using this skill.
To verify a Vercel webhook signature, compute a timing-safe HMAC-SHA1 hash using your VERCEL_WEBHOOK_SECRET against the raw request body and compare it to the x-vercel-signature header to authenticate payloads.
Vercel webhook events you can handle include deployment.created, deployment.succeeded, deployment.ready, deployment.error, deployment.canceled, deployment.promoted, project.created, project.removed, and project.renamed.
Yes, you can verify Vercel webhooks using FastAPI, Next.js, and Express. The Skill provides runnable examples across these frameworks to help you validate your secure endpoint setup.
Vercel webhook signature verification fails on parsed JSON because the HMAC-SHA1 computation requires the raw request body. You must enforce raw-body access before parsing to validate the x-vercel-signature header.
To prevent timing attacks during Vercel webhook validation, use timing-safe comparisons when checking the computed HMAC-SHA1 signature against the x-vercel-signature header.
Yes, you need the VERCEL_WEBHOOK_SECRET to process deployment events. It is required to compute the HMAC-SHA1 signature that authenticates incoming webhook payloads from Vercel.
hookdeckValidate Cursor Cloud Agent webhook signatures with HMAC-SHA256.
myapihqAutomate webhook-triggered actions with ordered steps and payload templating.
pauljbernardDesign scalable microservices architectures using Node.js and PostgreSQL.
Venkateshvenki404224Create secure Frappe webhook receivers and senders with HMAC-SHA256 verification.
