alchemy-webhooks

name	alchemy-webhooks
description	Receive and verify Alchemy Notify webhooks. Use when setting up Alchemy webhook handlers, debugging X-Alchemy-Signature verification, or handling onchain events like ADDRESS_ACTIVITY, MINED_TRANSACTION, DROPPED_TRANSACTION, NFT_ACTIVITY, NFT_METADATA_UPDATE, or GRAPHQL (Custom Webhook).
license	MIT
metadata	{"author":"hookdeck","version":"0.1.0","repository":"https://github.com/hookdeck/webhook-skills"}

Alchemy Webhooks

When to Use This Skill

• How do I receive Alchemy webhooks?
• How do I verify Alchemy webhook signatures (the X-Alchemy-Signature header)?
• How do I handle ADDRESS_ACTIVITY, MINED_TRANSACTION, or NFT_ACTIVITY events?
• Why is my Alchemy webhook signature verification failing?
• How do I set up Alchemy Notify webhooks for onchain activity?

Verification (core)

Alchemy signs every webhook with HMAC-SHA256 over the raw request body, hex-encoded, in the X-Alchemy-Signature header. There is no sha256= prefix and no timestamp — just the hex digest. The key is the per-webhook signing key (copied from the top-right of that webhook's detail page in the Notify dashboard, or fetched via the Notify API), not your app's Auth Token.

The alchemy-sdk npm package manages webhook CRUD but does not verify signatures — implement HMAC yourself. Always compute the HMAC over the body; a re-serialized JSON body will not match.