skills.rest
jrmatherly
jrmatherlyCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

webhook-security

Verify HMAC-SHA256 signatures and validate webhook payloads.

Updated Jan 30, 2026
Search Tags:#security#webhook#idempotency#signature-verification#webhook-delivery#HMAC-SHA256
One-click install
npx skills add https://github.com/jrmatherly/metorial-workspace --skill webhook-security
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: webhook-security
Source: https://github.com/jrmatherly/metorial-workspace/tree/main/.github/skills/webhook-security
Command: npx skills add https://github.com/jrmatherly/metorial-workspace --skill webhook-security

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This Skill provides a production-ready approach to receiving and validating external webhook payloads, preventing replay attacks and ensuring authenticated delivery.

Core Features & Use Cases

  • Signature verification using HMAC-SHA256 to authenticate messages.
  • Timestamp validation to thwart replay attacks.
  • Idempotency checks to avoid duplicate processing across Stripe, GitHub, Twilio, or custom webhooks.
  • Raw body handling to preserve signature integrity across languages (TypeScript/JavaScript and Python).

Quick Start

Configure your webhook endpoint to use the verifier, idempotency handler, and an eventIdExtractor to deduplicate events. For example, wire a POST /webhooks/your-service route to verify the signature, check for duplicates, parse the payload, and process the event in your business logic.

Frequently Asked Questions about webhook-security

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I verify webhook signatures using HMAC-SHA256 in my backend?▼

Webhook signature verification using HMAC-SHA256 authenticates incoming messages by validating a cryptographic hash against the raw request body. This Skill automates that verification process for TypeScript/JavaScript and Python backends to ensure payloads are from trusted sources.

What's the best way to prevent replay attacks when receiving webhooks from payment providers?▼

Preventing replay attacks requires validating timestamps embedded in webhook payloads to ensure they are within an acceptable time window. This Skill applies timestamp checks alongside signature verification to thwart delayed malicious request submissions.

How do I handle idempotency for duplicate Stripe or GitHub webhook deliveries?▼

Handling idempotency for duplicate webhook deliveries involves extracting event IDs and checking them against previously processed records. This Skill provides an eventIdExtractor and idempotency handler to deduplicate events from Stripe, GitHub, and Twilio.

Why does webhook signature verification fail when parsing JSON bodies in Python or JavaScript?▼

Webhook signature verification fails when JSON parsing alters the payload structure before hashing. This Skill ensures raw body handling to preserve signature integrity across TypeScript/JavaScript and Python backends.

Can I use this webhook security approach for custom services and not just standard providers?▼

Yes, this webhook security approach applies to custom services alongside standard providers like payment and version-control tools. It supports configurable verifiers and event extractors to authenticate and process diverse webhook payloads.

Do I need to configure safe response semantics after processing a webhook event?▼

Configuring safe response semantics is necessary to confirm successful webhook receipt and prevent automatic retries. This Skill satisfies safe response requirements after verifying signatures, checking idempotency, and processing the event.

Related Skills

Explore More Software Engineering Skills→
hookdeckhookdeck
79

hookdeck-event-gateway-webhooks

Verify Hookdeck webhook signatures and handle events in Express, Next.js, and FastAPI.

Official
Intermediate
irchamajiirchamaji

webhook-integration

Verify HMAC signatures and process Dodo Payments webhook events idempotently.

Community
Advanced
yanko-belovyanko-belov
13

idempotency

Ensures identical POST-like requests are processed only once via keyed lookup.

Community
Intermediate
solana-foundationsolana-foundation
46

integrate-webhook

Verify, parse, and process webhook events for Solana applications.

Official
Advanced