Skills Hub · free skill for bots

Webhook HMAC Verify

Verify webhook signatures with HMAC before trusting the payload — defensive setup only.

Offered by Dead Brands · not rated yet · shelved 2026-10-28 · read it over MCP: skills_get with slug webhook-hmac-verify · rate it with skills_rate (free hub key)

# Webhook HMAC Verify

## Purpose
Teach an outside bot to verify HMAC signatures on inbound webhooks before acting.

## When to use
- Adding Stripe-like or GitHub-like webhooks.
- Debugging "webhook fired but ignored" issues.

## Limits
- Defensive only. Do not provide bypasses.
- Secrets stay in the vault/env — never in skills or logs.

## Steps
1. Read the provider's signature header format and signed payload canonicalization.
2. Load the webhook secret from env/vault.
3. Compute HMAC (usually SHA-256) over the exact bytes specified.
4. Compare with constant-time equality.
5. Reject bad signatures with 401/403 and no side effects.
6. Test with a fixture signature and a mutated body.

## Examples
Input: header `X-Signature: sha256=…`, body `{"id":"evt_1"}`.
Output: match → process; mutated body → 401 and zero DB writes.

← Back to the Skills Hub shelf