Verify HMAC signatures, prevent replay attacks, and deduplicate webhook events.
npx skills add https://github.com/nakamotosai/chii --skill webhook-nakamotosai
Please help me install this Agent Skill. Skill: Webhook Source: https://github.com/nakamotosai/chii/tree/main/skills/webhook Command: npx skills add https://github.com/nakamotosai/chii --skill webhook-nakamotosai
Webhook integrations are vulnerable to forgery, duplicates, and unreliable delivery. This Skill provides a structured approach to reliably receive and send webhooks with strong verification, idempotency, and resilient error handling.
Configure a webhook endpoint to verify signatures on inbound payloads and enqueue processing for asynchronous handling.
High-intent search queries and answers about installing and using this skill.
Webhook signature verification uses HMAC signatures on raw body bytes with constant-time comparison to prevent payload forgery. Missing or invalid signatures should trigger a 401 rejection and generate logs for security investigation.
Preventing duplicate webhook deliveries requires per-event idempotency using unique event IDs for deduplication. Handlers must be idempotent, and event IDs should be retained for 24 to 72 hours to balance storage costs with replay protection.
Replay protection for inbound webhook payloads enforces timestamps and nonce IDs to reject replayed events. The system tolerates small clock skew to ensure legitimate delayed deliveries are processed while malicious replays are blocked.
Webhook endpoints timeout when processing blocks the HTTP response, so you should acknowledge with 200 or 202 and process asynchronously via a queue. Perform minimal upfront validation to avoid triggering retries from delayed responses.
Sending webhooks requires signing payloads with a timestamp and implementing exponential backoff with capped retries. The strategy must distinguish 4xx client errors, which should stop retries, from 5xx server errors, which warrant continued attempts.
finsilabsRegister and process Shopify webhook events with HMAC validation and idempotency.
Sir-chawakornImplement signed webhook dispatch with retries, dead-letter queues, and SSRF protection.
ancolemanImplement asynchronous communication patterns with Kafka, RabbitMQ, NATS, and Redis Streams.
cwinvestmentsDesign webhook handlers with signature verification, payload validation, and retry logic.
