What problem does it solve?
AI coding agents frequently implement webhook receivers incorrectly for Ruby on Rails applications: they skip signature verification, process webhook payloads synchronously, ignore retry semantics, and fail to implement idempotency, leading to security vulnerabilities, duplicate event processing, and unnecessary provider retries.
Core Features & Use Cases
- HMAC Signature Verification: Supports generic HMAC-SHA256 verification for providers like GitHub and Slack, plus provider-specific verification for Stripe, using timing-safe comparison to prevent timing attacks.
- Idempotent Event Processing: Persists webhook events with a unique index on provider and provider event ID to automatically deduplicate replayed or duplicate deliveries.
- Async Job Enqueuing: Enqueues all webhook processing to background jobs and returns a 200 response immediately to prevent provider retries from slow synchronous processing.
- Use Case: When integrating Stripe payment webhooks or GitHub push event webhooks into a Rails 8 app, this skill ensures you follow production-grade patterns that match senior Rails developer conventions.
Quick Start
Use the webhook-handling skill to build a secure, idempotent GitHub webhook receiver for your Rails application that verifies HMAC signatures, enqueues async processing jobs, and returns a 200 response immediately upon valid receipt.
