flexport-webhooks

name	flexport-webhooks
description	Receive and verify Flexport webhooks. Use when setting up Flexport webhook handlers, debugging X-Hub-Signature-256 signature verification, or handling freight and logistics milestone events like /shipment#created and /shipment_leg#departed.
license	MIT
metadata	{"author":"hookdeck","version":"0.1.0","repository":"https://github.com/hookdeck/webhook-skills"}

Flexport Webhooks

When to Use This Skill

• Setting up Flexport webhook handlers
• Debugging Flexport signature verification failures (X-Hub-Signature-256)
• Understanding Flexport Event objects and milestone identifiers
• Handling shipment, shipment leg, container, document, invoice, and purchase order events

Verification (core)

Flexport signs the raw request body with HMAC keyed on your per-endpoint secret token and sends two GitHub/X-Hub-style headers, each a hex digest prefixed with the algorithm:

• X-Hub-Signature-256 — HMAC-SHA256, formatted sha256=<hex> (use this)
• X-Hub-Signature — HMAC-SHA1, formatted sha1=<hex> (legacy, being deprecated)

Verify against the raw UTF-8 body before parsing JSON, and compare timing-safe.

Node:

 crypto = ();

 () {
   [algo, sig] = (signatureHeader || ).();
   (algo !==  || !sig)  ;
   expected = crypto.(, secret).(rawBody).();
   {
     crypto.(.(sig, ), .(expected, ));
  }  {
     ;
  }
}