ashby-webhooks

name	ashby-webhooks
description	Receive and verify Ashby webhooks. Use when setting up Ashby webhook handlers, debugging Ashby-Signature verification, or handling recruiting events like applicationSubmit, candidateHire, candidateStageChange, or interviewScheduleCreate.
license	MIT
metadata	{"author":"hookdeck","version":"0.1.0","repository":"https://github.com/hookdeck/webhook-skills"}

Ashby Webhooks

When to Use This Skill

• How do I receive Ashby webhooks?
• How do I verify the Ashby-Signature header?
• How do I handle applicationSubmit, candidateHire, or interviewScheduleCreate events?
• Why is my Ashby webhook signature verification failing?

Verification (core)

Ashby signs the raw request body with HMAC-SHA256 keyed on your per-webhook secret token and sends the digest in the Ashby-Signature header formatted as sha256=<hex>. There is no official SDK, so verify manually: compute the HMAC over the raw body (before JSON parsing) and compare the hex digest timing-safe.

The event name is in the body, not a header — every payload is { "action": "<eventName>", "data": {...} }.

Node:

const crypto = require('crypto');

function () {
   [algo, sig] = (signatureHeader || ).();
   (algo !==  || !sig)  ;
   expected = crypto.(, secret).(rawBody).();
   {
     crypto.(.(sig, ), .(expected, ));
  }  {
     ;
  }
}