| Adyen |
adyen-webhooks |
Verify Adyen webhook HMAC signatures (additionalData.hmacSignature), handle AUTHORISATION, CAPTURE, and REFUND notifications |
| Akeneo |
akeneo-webhooks |
Verify Akeneo PIM Events API webhook signatures (x-akeneo-request-signature, HMAC-SHA256 hex over timestamp.body), handle batched product and product-model events like product.created, product.updated, product.removed, product_model.created, product_model.updated, and product_model.removed |
| Ashby |
ashby-webhooks |
Verify Ashby webhook signatures (Ashby-Signature, HMAC-SHA256 hex over the raw body), handle recruiting events like applicationSubmit, candidateHire, candidateStageChange, and interviewScheduleCreate |
| Alipay |
alipay-webhooks |
Verify Alipay (Antom / Alipay+) webhook signatures (Signature header, RSA256 / SHA256withRSA, base64URL over <METHOD> <URI>\n<Client-Id>.<Request-Time>.<body>), sign the acknowledgement response, handle notifyPayment, notifyCapture, notifyRefund, notifyAuthorization, and notifyDispute events |
| Alchemy |
alchemy-webhooks |
Verify Alchemy Notify webhook signatures (X-Alchemy-Signature, HMAC-SHA256 hex over the raw body), handle ADDRESS_ACTIVITY, MINED_TRANSACTION, DROPPED_TRANSACTION, NFT_ACTIVITY, NFT_METADATA_UPDATE, and GRAPHQL events |
| Asana |
asana-webhooks |
Complete the Asana X-Hook-Secret handshake, verify X-Hook-Signature (HMAC-SHA256), handle batched compact events and heartbeats |
| Ascend |
ascend-webhooks |
Verify Ascend insurance-payment webhook signatures (X-Ascend-Signature, HMAC-SHA256 hex over <timestamp>:<raw_body>), handle invoice.paid, invoice.voided, payout.paid, and refund.paid events |
| Aircall |
aircall-webhooks |
Verify Aircall webhooks by timing-safe comparison of the token field in the JSON body (no signature header, no HMAC), handle cloud phone events like call.created, call.answered, call.ended, message.received, contact.updated, and user.connected.v2 |
| Airtable |
airtable-webhooks |
Verify Airtable webhook pings (X-Airtable-Content-MAC, HMAC-SHA256), fetch payloads with a cursor, manage 7-day webhook expiry |
| Airwallex |
airwallex-webhooks |
Verify Airwallex webhook signatures (x-signature / x-timestamp, HMAC-SHA256 hex over timestamp + raw body), handle payment_intent, payment_attempt, refund, payment_consent, and payment_dispute events |
| AiPrise |
aiprise-webhooks |
Verify AiPrise identity/KYC/KYB callback signatures (X-HMAC-SIGNATURE, HMAC-SHA256 hex keyed with your API private key), handle APPROVED, DECLINED, REVIEW, and UNKNOWN verification results |
| Attentive |
attentive-webhooks |
Verify Attentive webhook signatures (x-attentive-hmac-sha256, HMAC-SHA256 hex), handle SMS and email subscriber events |
| Auth0 |
auth0-webhooks |
Authenticate Auth0 Custom Log Stream deliveries (Authorization token), handle batched login and signup log events |
| AWS SNS |
aws-sns-webhooks |
Verify AWS SNS message signatures (RSA with SigningCertURL), confirm subscriptions, handle Notification envelopes |
| Azure Event Grid |
azure-event-grid-webhooks |
Receive Azure Event Grid deliveries, which carry no payload signature at all — trust comes from the ownership handshake (Microsoft.EventGrid.SubscriptionValidationEvent echoed as validationResponse with HTTP 200, or the CloudEvents v1.0 OPTIONS abuse-protection preflight) plus channel auth via a static delivery-property header, a query-parameter client secret, or a Microsoft Entra ID bearer token; guard on aeg-subscription-name and parse Event Grid arrays vs CloudEvents objects |
| BaseLinker |
baselinker-webhooks |
Receive BaseLinker (Base.com) order callbacks, which arrive as bodyless HTTP HEAD requests with the whole payload in the query string (observed: order_id, state) — there is no signature, secret, or handshake to verify, so respond with a bare bodyless 200 and fetch detail via getOrders (X-BLToken) |
| BigCommerce |
bigcommerce-webhooks |
Verify BigCommerce webhook callbacks (Standard Webhooks or custom headers), handle store/order and product events with API fetch-back |
| Bitbucket |
bitbucket-webhooks |
Verify Bitbucket webhook signatures (X-Hub-Signature, HMAC-SHA256), handle repo push and pull request events |
| Bridge |
bridge-xyz-webhooks |
Verify Bridge (bridge.xyz) webhook signatures (X-Webhook-Signature, RSA-SHA256 with a per-endpoint public key), handle customer, kyc_link, transfer, and virtual_account events |
| Bunny Stream |
bunny-stream-webhooks |
Verify Bunny Stream webhook signatures (X-BunnyStream-Signature, HMAC-SHA256 hex over the raw body, keyed on the library Read-Only API key), handle video encoding events by numeric Status (3 Finished, 5 Failed, 9 CaptionsGenerated, 10 TitleOrDescriptionGenerated) |
| Bridge API |
bridge-api-webhooks |
Verify Bridge API (bridgeapi.io, open-banking by Bridge/Bankin') webhook signatures (BridgeApi-Signature, HMAC-SHA256 hex with v1= scheme), handle item, item.account, payment.transaction, and user.deleted events |
| Calendly |
calendly-webhooks |
Verify Calendly webhook signatures (Calendly-Webhook-Signature, HMAC-SHA256 with timestamp), handle invitee.created and invitee.canceled events |
| Chargebee |
chargebee-webhooks |
Receive and verify Chargebee webhooks (Basic Auth), handle subscription billing events |
| Circle |
circle-webhooks |
Verify Circle CPN/Mint webhook signatures (X-Circle-Signature, ECDSA_SHA_256), handle payments, paymentIntents, transfers, and payouts notifications |
| Claude Managed Agents |
claude-managed-agents-webhooks |
Verify Anthropic Claude Managed Agents webhook signatures (X-Webhook-Signature), handle session lifecycle and outcome evaluation events |
| Clerk |
clerk-webhooks |
Verify Clerk webhook signatures, handle user, session, and organization events |
| Clio |
clio-webhooks |
Complete the Clio X-Hook-Secret handshake and verify X-Hook-Signature (HMAC-SHA256 hex), handle matter, contact, activity, and bill events |
| Cloudinary |
cloudinary-webhooks |
Verify Cloudinary notifications via the x-cld-signature / x-cld-timestamp headers (hex digest of raw body + timestamp + account API Secret, sha1 default or sha256) using the official SDK, handle upload, eager, delete, rename, moderation, and resource_tags_changed events |
| CloudSignal (Cloudprinter.com) |
cloudsignal-webhooks |
Authenticate CloudSignal (Cloudprinter.com) print-fulfilment webhooks via the plaintext per-endpoint Webhook API key in the JSON body's apikey field (no HMAC/signature header, timing-safe compared), handle CloudprinterOrderValidated, ItemValidated, ItemProduce, ItemProduced, ItemPacked, ItemShipped, ItemError, ItemCanceled, and CloudprinterOrderCanceled signals |
| Coinbase Commerce |
coinbase-commerce-webhooks |
Verify Coinbase Commerce webhook signatures (X-CC-Webhook-Signature, HMAC-SHA256), handle charge lifecycle events |
| Commerce Layer |
commercelayer-webhooks |
Verify Commerce Layer webhook signatures (X-CommerceLayer-Signature, HMAC-SHA256 base64), handle orders.place, orders.pay, and shipments.ship events |
| Community |
community-webhooks |
Verify Community (community.com SMS platform) webhook signatures (community-signature, HMAC-SHA256 hex over {t}.{raw_body}), handle message.inbound, message.outbound, member.created, member.updated, and member.deleted events |
| Courier |
courier-webhooks |
Verify Courier outbound webhook signatures (courier-signature, HMAC-SHA256 with timestamp), handle message:updated, notification:submitted, and audiences events |
| Cronofy |
cronofy-webhooks |
Verify Cronofy push notifications (Cronofy-HMAC-SHA256, a comma-separated list of base64 HMAC-SHA256 digests over the raw body keyed with the app client secret, any match wins), handle verification, change, profile_disconnected, conferencing_profile_disconnected, profile_initial_sync_completed, and gdpr_requested notifications |
| Cursor |
cursor-webhooks |
Verify Cursor Cloud Agent webhook signatures, handle agent status events |
| Customer.io |
customerio-webhooks |
Verify Customer.io reporting webhook signatures (X-CIO-Signature, v0 HMAC-SHA256 with timestamp), handle object_type + metric events |
| Deepgram |
deepgram-webhooks |
Receive and verify Deepgram transcription callbacks |
| Discord |
discord-webhooks |
Verify Discord webhook event signatures (Ed25519), handle application and entitlement events |
| eBay |
ebay-webhooks |
Complete the eBay endpoint challenge, verify the x-ebay-signature (ECDSA via getPublicKey), handle MARKETPLACE_ACCOUNT_DELETION notifications |
| DocuSign |
docusign-webhooks |
Verify DocuSign Connect signatures (X-DocuSign-Signature-N, HMAC-SHA256 base64), handle envelope and recipient events |
| ElevenLabs |
elevenlabs-webhooks |
Verify ElevenLabs webhook signatures, handle call transcription events |
| Enode |
enode-webhooks |
Verify Enode webhook signatures (x-enode-signature, HMAC-SHA1 hex over the raw body), handle EV and energy events like user:vehicle:updated, user:charger:updated, and user:battery:updated |
| Ethoca |
ethoca-webhooks |
Receive Ethoca (Mastercard) Alerts Push API webhooks — no HMAC signature; authenticity is mutual TLS (MSSL, Entrust CA) plus HTTP Basic Auth — dispatch fraud and dispute alerts on alertType |
| Exact Online |
exact-online-webhooks |
Verify Exact Online HashCode body signatures (HMAC-SHA256 over the Content node, hex, uppercased), subscribe to topics, handle Accounts, Items, StockPositions, GoodsDeliveries events |
| Favro |
favro-webhooks |
Verify Favro X-Favro-Webhook signatures (base64 HMAC-SHA1 over payloadId + the registered URL, NOT the body), accept the setup ping, handle card.created, card.committed, card.moved, card.updated, card.deleted, and comment.* events |
| Front |
frontapp-webhooks |
Verify Front application webhook signatures (X-Front-Signature, HMAC-SHA256 over timestamp + body), complete the X-Front-Challenge handshake, handle inbound, outbound, move, assign, and tag events |
| Fireblocks |
fireblocks-webhooks |
Verify Fireblocks webhook v2 signatures (detached JWS RS512 via JWKS), handle transaction lifecycle events |
| Facebook |
facebook-webhooks |
Verify Facebook Graph API webhook signatures (X-Hub-Signature-256, HMAC-SHA256), complete the hub.challenge handshake, handle Page and User field updates |
| Flexport |
flexport-webhooks |
Verify Flexport webhook signatures (X-Hub-Signature-256, HMAC-SHA256), handle freight milestone events like /shipment#created and /shipment_leg#departed |
| Fireflies |
fireflies-webhooks |
Verify Fireflies.ai Webhooks V2 signatures (X-Hub-Signature, sha256= + HMAC-SHA256 hex over the raw body), handle meeting.transcribed / meeting.summarized / meeting.bot_joined; legacy V1 documented |
| FastSpring |
fastspring-webhooks |
Verify FastSpring webhook signatures (X-FS-Signature, HMAC-SHA256 base64 over the raw body), iterate the batched events array, handle order.completed, subscription.activated, subscription.charge.completed, and subscription.canceled events |
| Faundit |
faundit-webhooks |
Verify Faundit lost-and-found / returns webhook signatures (X-Faundit-Signature-Next, HMAC-SHA256 hex over v1:<timestamp>:<body> with the X-Faundit-Timestamp header; deprecated v0 X-Faundit-Signature signs v0:<timestamp> only), handle the item-status and request-status events whose granular status (delivered, finished, expired, registered, resolved, …) is the data.status field |
| FusionAuth |
fusionauth-webhooks |
Verify FusionAuth JWT webhook signatures, handle user, login, and registration events |
| GitHub |
github-webhooks |
Verify GitHub webhook signatures, handle push, pull_request, and issue events |
| GitLab |
gitlab-webhooks |
Verify GitLab webhook tokens, handle push, merge_request, issue, and pipeline events |
| GoCardless |
gocardless-webhooks |
Verify GoCardless webhook signatures (Webhook-Signature, HMAC-SHA256), handle batched payment, mandate, and payout events |
| Google Gemini |
gemini-webhooks |
Verify Gemini API webhook signatures (Standard Webhooks HMAC + JWKS modes), handle batch and long-running operation events |
| Google Cloud Pub/Sub |
google-pubsub-webhooks |
Verify Google Cloud Pub/Sub push subscriptions — there is no signing secret or HMAC header; validate the Google-signed OIDC Authorization: Bearer JWT (iss, aud, email, email_verified), parse the message.data / attributes envelope, and ack within the deadline |
| Green Dot |
greendot-webhooks |
Authenticate Green Dot Embedded Finance (BaaS) webhook deliveries via the OAuth client_credentials Bearer token (scope post:webhook), verify the optional x-gd-signature header, echo x-GD-RequestId and return the responseDetails acknowledgement, handle transaction, accountUpdated, achTransfer, cardUpdate, billPayTransfer, directDepositSwitch, and provisioning events |
| HubSpot |
hubspot-webhooks |
Verify HubSpot v3 webhook signatures (HMAC-SHA256 with timestamp), handle contact, deal, and company events |
| Hugging Face |
huggingface-webhooks |
Authenticate Hugging Face webhooks (X-Webhook-Secret), handle repo, discussion, and comment events |
| Intercom |
intercom-webhooks |
Verify Intercom X-Hub-Signature (HMAC-SHA1), handle conversation, contact, and ticket events |
| Jira |
jira-webhooks |
Verify Jira webhook signatures (X-Hub-Signature, HMAC-SHA256), handle issue and comment events |
| Klaviyo |
klaviyo-webhooks |
Verify Klaviyo webhook signatures (HMAC-SHA256), handle flow-triggered webhook events |
| Knock |
knock-webhooks |
Verify Knock outbound webhook signatures (HMAC-SHA256 base64, millisecond timestamps), handle message lifecycle and resource change events |
| Linear |
linear-webhooks |
Verify Linear webhook signatures (HMAC-SHA256), handle issue, comment, and project events |
| Lithic |
lithic-webhooks |
Verify Lithic webhooks (Standard Webhooks / Svix, webhook-signature HMAC-SHA256) with the official SDK, handle card, transaction, payment, and dispute events |
| LinkedIn |
linkedin-webhooks |
Verify LinkedIn webhook signatures (X-LI-Signature, HMAC-SHA256) and the challengeCode validation, handle Lead Sync and organization events |
| Mailchimp |
mailchimp-webhooks |
Authenticate Mailchimp webhooks (URL secret + GET validation), handle subscribe, unsubscribe, and profile events |
| MailerSend |
mailersend-webhooks |
Verify MailerSend webhooks (Signature header, HMAC-SHA256 hex over the raw body), handle the webhook.test URL-validation ping and activity.sent, activity.delivered, activity.hard_bounced, activity.opened, activity.clicked, and activity.spam_complaint events |
| Mailgun |
mailgun-webhooks |
Verify Mailgun webhook signatures (HMAC-SHA256), handle email delivered, failed, opened, clicked, unsubscribed, and complained events |
| Cisco Meraki |
meraki-webhooks |
Verify Meraki Dashboard webhook alerts via the body sharedSecret (no HMAC header), handle motion_alert, settings_changed, sensor_alert, and stopped_reporting events |
| Microsoft Graph |
microsoft-graph-webhooks |
Validate Microsoft Graph change notifications (validationToken handshake, clientState, rich-notification JWTs), manage subscription lifecycle |
| Microsoft SharePoint |
microsoft-sharepoint-webhooks |
Answer the SharePoint validationtoken handshake, validate clientState (no HMAC), handle thin list notifications and resolve changes via GetChanges (ItemAdded, ItemUpdated, ItemDeleted) |
| Mollie |
mollie-webhooks |
Handle unsigned Mollie webhooks by fetching payment status from the API (fetch-to-confirm pattern) |
| Neon |
neon-webhooks |
Verify Neon Auth webhook signatures (EdDSA / Ed25519 detached JWS via JWKS, X-Neon-Signature), handle user.created, user.before_create, send.otp, send.magic_link, and phone_number.verified events |
| NMI |
nmi-webhooks |
Verify NMI (Network Merchants) Webhook-Signature (t=<nonce>,s=<sig>, HMAC-SHA256 over <nonce>.<raw_body>, hex) where t is a nonce not a timestamp, handle transaction.sale.success, transaction.auth.success, transaction.refund.success, and transaction.void.success events |
| monday.com |
monday-webhooks |
Verify monday.com webhook JWTs and the challenge handshake, handle item, column value, and update events |
| Notion |
notion-webhooks |
Verify Notion webhook signatures (HMAC-SHA256, X-Notion-Signature), complete handshake, handle page and comment events |
| Nuvemshop |
nuvemshop-webhooks |
Verify Nuvemshop (Tiendanube) webhook signatures (HMAC-SHA256 hex over raw body, x-linkedstore-hmac-sha256), handle order/created, order/paid, product/updated, and app/uninstalled events |
| Nylas |
nylas-webhooks |
Verify Nylas v3 webhook signatures (x-nylas-signature, HMAC-SHA256), answer the challenge handshake, handle CloudEvents-format grant, message, and calendar events |
| Okta |
okta-webhooks |
Complete the Okta Event Hook verification challenge, authenticate deliveries, handle user lifecycle and session events |
| OpenAI |
openai-webhooks |
Verify OpenAI webhooks for fine-tuning, batch, and realtime async events |
| OpenClaw |
openclaw-webhooks |
Verify OpenClaw Gateway webhook tokens, handle agent hook and wake event payloads |
| Orb |
orb-webhooks |
Verify Orb webhook signatures (HMAC-SHA256 over v1:{X-Orb-Timestamp}:{body}), handle customer, subscription, and invoice events |
| Oura |
oura-webhooks |
Complete the Oura subscription handshake, verify x-oura-signature (HMAC-SHA256 over timestamp + body, UPPERCASE), handle sleep, daily_readiness, daily_activity, and workout events |
| Paddle |
paddle-webhooks |
Verify Paddle webhook signatures, handle subscription and billing events |
| PayPal |
paypal-webhooks |
Verify PayPal webhook signatures (RSA-SHA256 with cert), handle payment, subscription, and order events |
| PayPro Global |
paypro-global-webhooks |
Verify PayPro Global IPN webhooks (form-encoded): SIGNATURE (SHA256 over ORDER_ID+ORDER_STATUS+ORDER_TOTAL_AMOUNT+CUSTOMER_EMAIL+VALIDATION_KEY+TEST_MODE+IPN_TYPE_NAME) and HASH (MD5 of ORDER_ID+SecretKey), handle OrderCharged, OrderRefunded, and SubscriptionChargeSucceed events |
| Paymob |
paymob-webhooks |
Verify Paymob transaction callbacks (HMAC-SHA512 hex over 20 ordered fields, delivered as the ?hmac= query param — not a header, not the raw body), read transaction state from success/is_refunded/is_voided/is_capture booleans |
| Pipedrive |
pipedrive-webhooks |
Authenticate Pipedrive webhooks (HTTP Basic Auth — no signature), handle create.deal, change.person, and delete.activity events |
| Persona |
persona-webhooks |
Verify Persona webhook signatures (Persona-Signature, t=/v1= HMAC-SHA256 pairs), handle inquiry and verification events |
| Paystack |
paystack-webhooks |
Verify Paystack webhook signatures (x-paystack-signature, HMAC-SHA512), handle charge, transfer, and subscription events |
| Polar |
polar-webhooks |
Verify Polar webhook signatures (Standard Webhooks), handle order, subscription, and checkout events |
| Picqer |
picqer-webhooks |
Verify Picqer webhook signatures (X-Picqer-Signature, HMAC-SHA256 base64), handle order, picklist, and stock events |
| Postmark |
postmark-webhooks |
Authenticate Postmark webhooks (Basic Auth/Token), handle email delivery, bounce, open, click, and spam events |
| Praxis |
praxis-webhooks |
Verify Praxis (Cashier) webhook signatures (gt-authentication, SHA-384 hex over ordered field values + Merchant Secret — not HMAC, not Standard Webhooks), sign the acknowledgement (external-request-signature), handle Payment Notification transaction_status (pending, approved, rejected, error) and Subscription Notification events |
| Pylon |
pylon-webhooks |
Verify Pylon webhook signatures (Pylon-Webhook-Signature, hs256= HMAC-SHA256 over timestamp.body), handle B2B support issue events like issue.created and issue.updated |
| Quoter |
quoter-webhooks |
Verify Quoter webhooks (weak MD5 hash form field over HASH_KEY + timestamp + data, NOT HMAC and NOT Standard Webhooks — the hash key is optional), parse the x-www-form-urlencoded hash/timestamp/data payload, dispatch Quote, Person, and Payment create/update deliveries by ?object= |
| Razorpay |
razorpay-webhooks |
Verify Razorpay webhook signatures (X-Razorpay-Signature, HMAC-SHA256), handle payment and order events |
| Recharge |
recharge-webhooks |
Verify Recharge webhooks (X-Recharge-Hmac-Sha256, plain SHA-256 of secret + body, not HMAC), handle charge, subscription, and order events |
| Recurly |
recurly-webhooks |
Authenticate Recurly webhooks (Basic Auth), parse XML notifications for subscription and payment events |
| Replicate |
replicate-webhooks |
Verify Replicate webhook signatures, handle ML prediction lifecycle events |
| Resend |
resend-webhooks |
Verify Resend webhook signatures, handle email delivery and bounce events |
| RingCentral |
ringcentral-webhooks |
Complete the RingCentral Validation-Token handshake, check the optional Verification-Token header, handle message-store, presence, and telephony session events |
| Retell AI |
retell-webhooks |
Verify Retell webhook signatures (X-Retell-Signature, HMAC-SHA256), handle voice call events like call_started, call_ended, call_analyzed |
| Revolut |
revolut-webhooks |
Verify Revolut Merchant API webhook signatures (Revolut-Signature, HMAC-SHA256 over v1.{timestamp}.{body}), handle order events |
| Salesforce |
salesforce-webhooks |
Handle Salesforce Outbound Messages (SOAP/XML), validate OrganizationId, return the required Ack response |
| Sanity |
sanity-webhooks |
Verify Sanity GROQ-powered webhook signatures (sanity-webhook-signature, HMAC-SHA256 base64url), handle document change events |
| Scrapfly |
scrapfly-webhooks |
Verify Scrapfly webhook signatures (HMAC-SHA256, uppercase/lowercase hex), dispatch scrape, extraction, and screenshot jobs |
| SendGrid |
sendgrid-webhooks |
Verify SendGrid webhook signatures (ECDSA), handle email delivery events |
| ShipBob |
shipbob-webhooks |
Verify ShipBob webhook signatures (Standard Webhooks/Svix, webhook-signature), dispatch on x-webhook-topic, handle order.shipped, delivery, return, and WRO events |
| ShipHero |
shiphero-webhooks |
Verify ShipHero webhook signatures (x-shiphero-hmac-sha256, base64 HMAC-SHA256 of the raw body), dispatch on the payload webhook_type field, handle Order Allocated, Shipment Update, Inventory Update, and Return Update events |
| ShipStation |
shipstation-webhooks |
Handle ShipStation V1 thin-payload webhooks (fetch resource_url with Basic auth), cover ORDER_NOTIFY and SHIP_NOTIFY events |
| Shopify |
shopify-webhooks |
Verify Shopify HMAC signatures, handle order and product webhook events |
| SHOPLINE |
shopline-webhooks |
Verify SHOPLINE HMAC signatures (X-Shopline-Hmac-Sha256, base64 with hex fallback), handle orders/create, products/update, and collect/delete events |
| Slack |
slack-webhooks |
Verify Slack Events API signatures (HMAC-SHA256, X-Slack-Signature), handle message, app_mention, and reaction events |
| Solidgate |
solidgate-webhooks |
Verify Solidgate webhook signatures (merchant + signature headers, HMAC-SHA512 with base64-of-hex double-encode), handle card_gate.order.updated, subscription.updated.v2, and chargeback events |
| Smartcar |
smartcar-webhooks |
Verify Smartcar webhook signatures (SC-Signature, hex HMAC-SHA256 keyed with the Application Management Token), answer the VERIFY challenge, handle VEHICLE_STATE and VEHICLE_ERROR events |
| Smile API |
smile-webhooks |
Verify Smile API (getsmileapi.com, SE Asia employment/income data — not Smile.io or Smile Identity) webhook signatures (Smile-Signature, HMAC-SHA512 hex over the raw body), dedupe on the event id, handle ACCOUNT_CONNECTED, TASK_FINISHED, INCOMES_ADDED, EMPLOYMENTS_ADDED, IDENTITY_ADDED, and RECORD_COMPLETED events |
| Square |
square-webhooks |
Verify Square webhook signatures (x-square-hmacsha256-signature over URL + body), handle payment and refund events |
| Statsig |
statsig-webhooks |
Verify Statsig Event Webhook signatures (HMAC-SHA256 over v0:ts:body, X-Statsig-Signature), handle exposure and config-change batches |
| Strava |
strava-webhooks |
Complete the Strava subscription validation handshake (hub.challenge/hub.verify_token), handle activity and athlete deauthorization events |
| Stripe |
stripe-webhooks |
Verify Stripe webhook signatures, parse payment event payloads, handle checkout.session.completed events |
| Supabase |
supabase-webhooks |
Handle both Supabase surfaces: Database Webhooks (INSERT/UPDATE/DELETE via pg_net triggers, unsigned — authenticate with a developer-configured shared-secret header) and Auth Hooks (Standard Webhooks HMAC-SHA256 over {webhook-id}.{webhook-timestamp}.{raw_body}, v1,whsec_ secret), covering send_email, send_sms, custom_access_token, before_user_created, mfa_verification_attempt, and password_verification_attempt |
| Synctera |
synctera-webhooks |
Verify Synctera BaaS webhooks (custom HMAC-SHA256 hex over {Request-Timestamp}.{raw_body}, Synctera-Signature + Request-Timestamp headers, secret from POST /v0/webhook_secrets, rolling secret support), handle ACCOUNT.UPDATED, CARD.CREATED, TRANSACTION.CREATED, and DISPUTE.CREATED events |
| Tally |
tally-webhooks |
Verify Tally webhook signatures (Tally-Signature, HMAC-SHA256 base64, optional signing secret), handle FORM_RESPONSE submission events |
| Tebex |
tebex-webhooks |
Verify Tebex webhook signatures (X-Signature, two-step HMAC-SHA256 of the SHA-256 body hash), answer the validation.webhook handshake, handle payment, dispute, and recurring-payment events |
| Telnyx |
telnyx-webhooks |
Verify Telnyx Webhook API v2 signatures (Ed25519, telnyx-signature-ed25519 + telnyx-timestamp), handle message.received, message.sent, and message.finalized events |
| Token.io |
tokenio-webhooks |
Verify Token.io open banking webhook signatures (asymmetric Ed25519, token-signature over the raw body, token-event for the type), subscribe via PUT /webhook/config, handle PAYMENT_STATUS_CHANGED, REFUND_STATUS_CHANGED, VRP_STATUS_CHANGED, and VIRTUAL_ACCOUNT_CREDIT_RECEIVED events |
| Treezor |
treezor-webhooks |
Verify Treezor BaaS webhook signatures (object_payload_signature body field, HMAC-SHA256 base64 over the canonicalized object_payload, not the raw body), handle banking events like payin.create, cardtransaction.create, and user.kycreview |
| Trello |
trello-webhooks |
Verify Trello webhook signatures (x-trello-webhook, HMAC-SHA1 over body + callbackURL), answer the HEAD check, handle board and card actions |
| TikTok |
tiktok-webhooks |
Verify TikTok for Developers webhook signatures (TikTok-Signature, HMAC-SHA256 hex over <timestamp>.<body>), handle authorization.removed, video.upload.failed, video.publish.completed, and portability.download.ready events |
| TikTok Shop |
tiktok-shop-webhooks |
Verify TikTok Shop webhook signatures (Authorization header, HMAC-SHA256 over app_key + body), handle order, package, and product events |
| Svix |
svix-webhooks |
Verify Svix-delivered webhook signatures (svix-signature/webhook-signature, HMAC-SHA256) for any provider that sends webhooks via Svix |
| Twilio |
twilio-webhooks |
Verify Twilio webhook signatures (HMAC-SHA1, X-Twilio-Signature), handle SMS, voice, and status callback events |
| USPS |
usps-webhooks |
Verify USPS tracking webhook signatures (HMAC-SHA256 Base64 over timestamp + payload, X-HMAC), create tracking subscriptions, handle delivery events |
| Uber |
uber-webhooks |
Verify Uber Eats webhook signatures (HMAC-SHA256 hex, X-Uber-Signature, keyed with client secret), handle orders.notification, orders.cancel, and store events |
| Upollo |
upollo-webhooks |
Verify Upollo fraud/risk webhook signatures (Upollo-Signature, t:/s0: HMAC-SHA512 over the raw body), react to flags like ACCOUNT_SHARING and MULTIPLE_ACCOUNTS and the recommended action (CHALLENGE/DENY/PERMIT) |
| Utila |
utila-webhooks |
Verify Utila webhook signatures (x-utila-signature, asymmetric RSA-4096 + SHA-512 + PSS, no shared secret), handle TRANSACTION_CREATED, TRANSACTION_STATE_UPDATED, WALLET_CREATED, WALLET_ADDRESS_CREATED, and TRANSACTION_AML_SCREENING_RESULT_READY events |
| Twitch |
twitch-webhooks |
Verify Twitch EventSub signatures (Twitch-Eventsub-Message-Signature, HMAC-SHA256), answer challenges, handle stream and channel events |
| Typeform |
typeform-webhooks |
Verify Typeform webhook signatures (Typeform-Signature, HMAC-SHA256 base64), handle form_response events |
| Twitter/X |
twitter-webhooks |
Verify Twitter/X Account Activity webhook signatures (x-twitter-webhooks-signature, HMAC-SHA256) and answer CRC challenges, handle tweet, favorite, and DM events |
| Vercel |
vercel-webhooks |
Verify Vercel webhook signatures (HMAC-SHA1), handle deployment and project events |
| Vapi |
vapi-webhooks |
Authenticate Vapi "Server URL" webhooks with a shared secret (Authorization: Bearer or legacy X-Vapi-Secret, timing-safe compare — Vapi has no fixed HMAC scheme; OAuth 2.0 and a configurable HMAC are also supported), dispatch on the nested message.type, and return the required JSON body for the request/response types assistant-request, tool-calls, transfer-destination-request, and knowledge-base-request |
| Walmart |
walmart-webhooks |
Verify Walmart Marketplace performance webhook signatures (WM_SEC.SIGNATURE, HMAC-SHA256 over method + path + timestamp + body hash), handle PO_CREATED, INVENTORY_OOS, OFFER_PUBLISHED, and BUY_BOX_CHANGED events |
| Vercel Log Drains |
vercel-log-drains-webhooks |
Verify Vercel Log Drain deliveries (x-vercel-signature, HMAC-SHA1) and the x-vercel-verify handshake, handle batched json/ndjson log events |
| Webflow |
webflow-webhooks |
Verify Webflow webhook signatures (HMAC-SHA256), handle form submission, ecommerce, and CMS events |
| WeChat Pay |
wechat-webhooks |
Verify WeChat Pay APIv3 notification signatures (Wechatpay-Signature, SHA256withRSA over {timestamp}\n{nonce}\n{body}\n with the platform public key), decrypt the AEAD_AES_256_GCM resource, handle TRANSACTION.SUCCESS, REFUND.SUCCESS, and REFUND.CLOSED events |
| Wix |
wix-webhooks |
Verify Wix webhook JWTs (RS256 with your app's public key) for self-hosted apps, handle wix.ecom.v1.order_created, order_approved, order_updated, and order_canceled events |
| WhatsApp |
whatsapp-webhooks |
Verify WhatsApp Business Platform webhook signatures (X-Hub-Signature-256), complete the GET handshake, handle inbound messages and status updates |
| WooCommerce |
woocommerce-webhooks |
Verify WooCommerce webhook signatures, handle order, product, and customer events |
| WorkOS |
workos-webhooks |
Verify WorkOS webhook signatures (WorkOS-Signature, HMAC-SHA256 with timestamp), handle Directory Sync and auth events |
| Xero |
xero-webhooks |
Verify Xero webhook signatures (x-xero-signature, HMAC-SHA256 base64), pass Intent to Receive (ITR) with 200/401, handle CONTACT, INVOICE, CREDITNOTE, and SUBSCRIPTION events |
| Zendesk |
zendesk-webhooks |
Verify Zendesk webhook signatures (X-Zendesk-Webhook-Signature, HMAC-SHA256 with timestamp), handle event subscriptions and trigger-based webhooks |
| Zero Hash |
zerohash-webhooks |
Verify Zero Hash webhook signatures (x-zh-hook-signature, HMAC-SHA256 hex over payload + timestamp with replay protection; legacy x-zh-hook-signature-256), handle trade_status_changed and account_balance.changed events |
| Zift |
zift-webhooks |
Receive Zift payment notifications — no HMAC signature; acknowledge each delivery by echoing {"notificationId": ...} — dispatch billing.* and processing.* events like billing.subscription-created, processing.chargeback, and processing.return |
| Zoom |
zoom-webhooks |
Verify Zoom webhook signatures (x-zm-signature), complete the URL validation handshake, handle meeting and recording events |