| name | courier-webhooks |
| description | Receive and verify Courier outbound webhooks. Use when setting up Courier webhook handlers, debugging courier-signature verification, or handling notification and audience events like message:updated, notification:submitted, or audiences:updated.
|
| license | MIT |
| metadata | {"author":"hookdeck","version":"0.1.0","repository":"https://github.com/hookdeck/webhook-skills"} |
Courier Webhooks
When to Use This Skill
- How do I receive Courier outbound webhooks?
- How do I verify the Courier
courier-signature header?
- How do I handle
message:updated status changes or notification:submitted events?
- Why is my Courier webhook signature verification failing?
Verification (core)
Courier signs every outbound webhook with HMAC-SHA256. The courier-signature
header carries a timestamp and hex signature: t=<timestamp>,signature=<hex_digest>.
The signed content is `${timestamp}.${rawBody}` — the timestamp, a literal dot,
then the raw request body (do not JSON.parse before verifying). Courier has no
webhook-verification SDK, so verify manually and compare in constant time.
Courier does not document whether t is in seconds or milliseconds, so normalize it
before the staleness comparison instead of assuming a unit. The 5-minute tolerance
below is this skill's default, not a window Courier publishes — tune it to your needs.
