monday-webhooks

name	monday-webhooks
description	Receive and verify monday.com webhooks. Use when setting up monday.com webhook handlers, implementing the challenge handshake, debugging JWT verification, or handling board events like create_item, change_column_value, change_status_column_value, create_update, or create_subitem.
license	MIT
metadata	{"author":"hookdeck","version":"0.1.0","repository":"https://github.com/hookdeck/webhook-skills"}

monday.com Webhooks

When to Use This Skill

• Setting up monday.com webhook handlers
• Implementing the challenge handshake required at registration
• Debugging JWT (Authorization header) verification failures
• Understanding monday.com event types and the event payload wrapper
• Handling board, column, subitem, and update events

Two things every monday.com endpoint must do

monday.com webhooks are unusual — there are two separate checks, not one:

1. Challenge handshake (required). When a webhook is created, monday.com POSTs { "challenge": "<token>" }. Your endpoint must echo it back as { "challenge": "<token>" } or registration fails. This is the only check guaranteed for every webhook, including no-code and personal-token webhooks.
2. JWT verification (when present). For webhooks created by an integration app, monday.com signs each request with a (HS256), signed with your app's . Verify it with a JWT library. Webhooks created with a personal API token or the no-code board integration may send this header.