webhook-security

What problem does it solve?

This Skill provides a production-ready approach to receiving and validating external webhook payloads, preventing replay attacks and ensuring authenticated delivery.

Core Features & Use Cases

• Signature verification using HMAC-SHA256 to authenticate messages.
• Timestamp validation to thwart replay attacks.
• Idempotency checks to avoid duplicate processing across Stripe, GitHub, Twilio, or custom webhooks.
• Raw body handling to preserve signature integrity across languages (TypeScript/JavaScript and Python).

Quick Start

Configure your webhook endpoint to use the verifier, idempotency handler, and an eventIdExtractor to deduplicate events. For example, wire a POST /webhooks/your-service route to verify the signature, check for duplicates, parse the payload, and process the event in your business logic.