nylas-webhooks

name	nylas-webhooks
description	Receive and verify Nylas webhooks. Use when setting up Nylas webhook handlers, debugging x-nylas-signature verification, completing the challenge handshake, or handling email and calendar events like message.created, message.opened, event.created, event.updated, or grant.expired.
license	MIT
metadata	{"author":"hookdeck","version":"0.1.0","repository":"https://github.com/hookdeck/webhook-skills"}

Nylas Webhooks

When to Use This Skill

• How do I receive Nylas webhooks?
• How do I verify Nylas webhook signatures (x-nylas-signature)?
• How do I respond to the Nylas challenge handshake when creating a webhook?
• How do I handle message.created, message.opened, event.created, or grant.expired events?
• Why is my Nylas webhook signature verification failing (gzip / raw body)?

Verification (core)

Nylas signs the raw request body with HMAC-SHA256 keyed on your per-destination webhook_secret and sends the digest as a hex string in the x-nylas-signature header (casing varies — read it case-insensitively). This is not Standard Webhooks: there is no webhook-id/webhook-timestamp; only the body is signed. Verify the raw bytes JSON parsing, and if , verify against the bytes and decompress only after the check passes. Nylas SDKs expose webhook CRUD, , and , but — implement the HMAC check yourself with a constant-time comparison.