Hookdeck skills

Receive and verify Razorpay webhooks. Use when setting up Razorpay webhook handlers, debugging X-Razorpay-Signature verification, or handling payment events like payment.captured, payment.failed, order.paid, refund.processed, or subscription.charged.

Receive and verify Stripe webhooks. Use when setting up Stripe webhook handlers, debugging signature verification, or handling payment events like payment_intent.succeeded, customer.subscription.created, or invoice.paid.

Receive and verify Svix webhooks (the Standard Webhooks scheme used by many providers). Use when setting up a Svix webhook handler, debugging svix-id / svix-timestamp / svix-signature verification, handling secret rotation with multiple signatures, or parsing the {"type": "...", "data": {...}} envelope for events like invoice.paid, user.created, or message.sent.

Receive and verify Vercel Log Drains deliveries. Use when setting up a Vercel log drain HTTP endpoint, debugging x-vercel-signature verification, handling the x-vercel-verify endpoint handshake, or processing batched log entries from sources like lambda, edge, build, static, external, firewall, and redirect.

Receive and verify WhatsApp Business Platform (Cloud API) webhooks from Meta. Use when setting up WhatsApp webhook handlers, completing the GET verification handshake, debugging X-Hub-Signature-256 signature verification, or handling inbound message and message status (sent, delivered, read, failed) events under the whatsapp_business_account object.

Receive and verify Supabase webhooks. Use when setting up Supabase Database Webhooks (INSERT, UPDATE, DELETE table events sent via pg_net triggers) or Supabase Auth Hooks (send_email, send_sms, custom_access_token, before_user_created, mfa_verification_attempt, password_verification_attempt), debugging Standard Webhooks signature verification with the webhook-id, webhook-timestamp and webhook-signature headers, or handling the `v1,whsec_` secret format.

Receive and verify Vercel webhooks. Use when setting up Vercel webhook handlers, debugging signature verification, or handling deployment events like deployment.created, deployment.succeeded, or project.created.

Receive and verify Alchemy Notify webhooks. Use when setting up Alchemy webhook handlers, debugging X-Alchemy-Signature verification, or handling onchain events like ADDRESS_ACTIVITY, NFT_ACTIVITY, or GRAPHQL (Custom Webhook).

Receive BaseLinker (Base.com) webhooks. Use when building a BaseLinker order or warehouse callback receiver, because BaseLinker is not a normal webhook source: deliveries arrive as HTTP HEAD requests with NO body, the entire payload is in the query string (observed params: order_id, state), there is NO signature verification of any kind (no HMAC, no secret, no handshake), and your response must be a bare bodyless 200. Use when debugging an empty req.body, wiring app.head / an exported HEAD route handler / @app.head, or polling getJournalList for change tracking.

Receive and verify Zendesk webhooks. Use when setting up Zendesk webhook handlers, debugging signature verification (X-Zendesk-Webhook-Signature), or handling event subscriptions like zen:event-type:ticket.created, zen:event-type:ticket.comment_added, or trigger/automation webhooks.

Receive and verify Formstack Forms webhooks (the "WebHook" submit action, aka "Send Data to an External URL"). Use when setting up a Formstack form submission webhook handler, debugging X-FS-Signature HMAC verification, handling application/x-www-form-urlencoded or JSON submission payloads, or working out which fields a form will POST. Formstack has NO event types — a WebHook fires on exactly one thing, a form submission — so handlers key off FormID, not an event name.

Receive and verify NMI (Network Merchants) webhooks. Use when setting up NMI webhook handlers, debugging Webhook-Signature verification, or handling transaction events like transaction.sale.success, transaction.auth.success, transaction.refund.success, and transaction.void.success. Note: NMI does NOT use Standard Webhooks — the Webhook-Signature header is "t=<nonce>,s=<sig>" (comma-separated) where t is a NONCE (not a Unix timestamp), and the signature is HMAC-SHA256 over "<nonce>.<raw_body>", lowercase hex.

Receive and verify Airwallex webhooks. Use when setting up Airwallex webhook handlers, debugging x-signature / x-timestamp signature verification, or handling payment events like payment_intent.succeeded, payment_attempt.paid, refund.settled, payment_consent.verified, or payment_dispute.requires_response.

Receive and verify Community (community.com) SMS platform webhooks. Use when setting up a Community webhook handler, debugging `community-signature` HMAC-SHA256 verification, or handling message.inbound, message.outbound, member.created, member.updated, and member.deleted events.

Receive and verify Bitbucket Cloud webhooks. Use when setting up Bitbucket webhook handlers, debugging X-Hub-Signature verification, or handling repository and pull request events like repo:push, pullrequest:created, pullrequest:updated, pullrequest:fulfilled, or pullrequest:rejected.

Receive and verify Sentry webhooks (sentry.io — the error-monitoring and application-performance platform). Use when setting up a Sentry Integration Platform webhook handler for an internal or public integration, debugging Sentry-Hook-Signature verification, or handling events like issue.created, issue.resolved, event_alert.triggered, metric_alert.critical, error.created, comment.created, seer.pr_created or preprod_artifact.size_analysis_completed. Sentry signs with HMAC-SHA256 over the RAW body, lowercase hex, keyed with the integration's Client Secret, and sends the digest as Sentry-Hook-Signature (or Sentry-App-Signature on UI-component requests). The resource is only in the Sentry-Hook-Resource header — the body has no event/type field. Not Sentry Insurance (sentry.com), not @sentry/* SDK event ingest.

Receive and verify CloudSignal webhooks from Cloudprinter.com. Use when setting up a CloudSignal Webhooks v2.0 receiver, authenticating deliveries by the plaintext `apikey` field in the JSON body (there is NO HMAC signature header), or handling print order/item status signals like CloudprinterOrderValidated, ItemProduced, ItemShipped, ItemError, and ItemCanceled.

Hookdeck Outpost — open-source infrastructure for sending webhooks and events to user-preferred destinations (HTTP, SQS, RabbitMQ, Pub/Sub, EventBridge, Kafka). Use when building a SaaS platform that needs to deliver events to customers.

Receive and verify Wix webhooks. Use when setting up Wix webhook handlers for self-hosted/self-managed apps, debugging JWT signature verification with your app's public key, or handling events like wix.ecom.v1.order_created, wix.ecom.v1.order_approved, wix.ecom.v1.order_updated, and wix.ecom.v1.order_canceled.

Receive and verify Zoom webhooks. Use when setting up Zoom webhook handlers, debugging signature verification, completing the endpoint.url_validation handshake, or handling meeting and recording events like meeting.started, meeting.ended, meeting.participant_joined, or recording.completed.

Receive and verify Coinbase Commerce webhooks. Use when setting up Coinbase Commerce webhook handlers, debugging X-CC-Webhook-Signature verification, or handling cryptocurrency payment events like charge:created, charge:confirmed, charge:failed, charge:pending, charge:delayed, and charge:resolved.

Receive and verify HubSpot webhooks. Use when setting up HubSpot webhook handlers, debugging X-HubSpot-Signature-v3 signature verification, or handling CRM events like contact.creation, contact.propertyChange, or deal.creation.

Receive and verify Slack Events API webhooks. Use when setting up Slack webhook handlers, debugging Slack signature verification, handling the url_verification challenge, or processing events like app_mention, message, reaction_added, team_join, or app_home_opened.

Best practices for webhook handlers. Use when implementing the handler sequence (verify first, parse second, handle idempotently), idempotency, error handling, retry logic, or framework-specific issues with Express, Next.js, or FastAPI.