Webhook Handler

Verify HMAC-SHA256 signatures and process webhook events idempotently with Redis deduplication.

1|Updated Sep 14, 2025

Search Tags:#security #api integration #webhook #stripe #idempotency #event processing

Ready to run

npx skills add https://github.com/CleanExpo/DR-NRPG --skill webhook-handler-cleanexpo

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: Webhook Handler
Source: https://github.com/CleanExpo/DR-NRPG/tree/main/.skills/custom/webhook-handler
Command: npx skills add https://github.com/CleanExpo/DR-NRPG --skill webhook-handler-cleanexpo

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) components.

What problem does it solve?

This Skill streamlines the integration of external services by providing a robust and secure way to handle incoming webhooks, ensuring data integrity and preventing duplicate processing.

Core Features & Use Cases

Signature Verification: Ensures that incoming webhooks are legitimate and come from the expected source using HMAC-SHA256.
Idempotent Processing: Guarantees that each webhook event is processed exactly once, even if delivered multiple times.
Event Schema Typing: Provides structured, typed event data for easier and safer handling.
Outbound Delivery: Enables sending signed webhooks to external systems with retry mechanisms.
Use Case: Integrate Stripe payments by securely verifying incoming checkout.session.completed events and processing them idempotently to update order statuses.

Quick Start

Apply the webhook-handler skill to secure an incoming webhook endpoint by verifying its HMAC-SHA256 signature and timestamp.

Frequently Asked Questions about Webhook Handler

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I verify Stripe webhook signatures in Node.js?▼

Verify Stripe webhook signatures in Node.js using HMAC-SHA256 cryptographic validation to ensure incoming payloads are legitimate and originate from the expected source, preventing unauthorized API integration requests.

What is idempotent event processing for webhooks?▼

Idempotent event processing guarantees each webhook is handled exactly once, even if delivered multiple times. It uses Redis-backed deduplication to prevent duplicate actions like charging a customer twice for the same Stripe event.

How do I handle failed webhook deliveries and retries?▼

Handle failed webhook deliveries by implementing outbound delivery with automatic retry mechanisms and dead letter storage, capturing persistently failed asynchronous communication events for later analysis and manual reprocessing.

Can I use Redis for webhook deduplication in a Node.js application?▼

Yes, you can use Redis for webhook deduplication in a Node.js application. This approach provides fast, temporary storage to track processed event IDs, ensuring reliable idempotent event processing across distributed systems.

What is the best way to structure typed event schemas for API integration?▼

The best way to structure typed event schemas for API integration is to enforce strict data typing on incoming payloads. This provides structured event data for safer, predictable handling of services like Stripe and GitHub.

Why are my duplicate webhook events updating the database multiple times?▼

Duplicate webhook events update the database multiple times because of a lack of idempotency. Implementing Redis-backed deduplication ensures each event processes exactly once, preventing redundant database writes from repeated deliveries.