fastspring-webhooks

name	fastspring-webhooks
description	Receive and verify FastSpring webhooks. Use when setting up FastSpring webhook handlers, debugging X-FS-Signature verification, or handling ecommerce events like order.completed, subscription.activated, subscription.charge.completed, and subscription.canceled.
license	MIT
metadata	{"author":"hookdeck","version":"0.1.0","repository":"https://github.com/hookdeck/webhook-skills"}

FastSpring Webhooks

When to Use This Skill

• Setting up FastSpring webhook handlers
• How do I verify FastSpring webhook signatures?
• Why is my X-FS-Signature verification failing?
• Handling order.completed, subscription.activated, or subscription.charge.completed events
• Iterating the batched events array FastSpring delivers in each POST

Verification (core)

FastSpring signs the exact raw request body with HMAC-SHA256 keyed on your per-webhook HMAC SHA256 Secret, base64-encodes the digest, and sends it in the X-FS-Signature header. Pass the raw body (do not parse/re-serialize first), recompute, and compare timing-safe. Each POST batches multiple events in an events array — verify the signature once against the whole body, then iterate.