picqer-webhooks

name	picqer-webhooks
description	Receive and verify Picqer webhooks. Use when setting up Picqer webhook handlers, debugging X-Picqer-Signature verification, or handling warehouse and order events like orders.completed, picklists.closed, or products.stock_changed.
license	MIT
metadata	{"author":"hookdeck","version":"0.1.0","repository":"https://github.com/hookdeck/webhook-skills"}

Picqer Webhooks

When to Use This Skill

• How do I receive Picqer webhooks?
• How do I verify Picqer webhook signatures (X-Picqer-Signature)?
• How do I handle orders.completed, picklists.closed, or products.stock_changed events?
• Why is my Picqer webhook signature verification failing?
• Setting up a Picqer hook via the API (POST /api/v1/hooks)

Verification (core)

Picqer signs the raw request body with HMAC-SHA256 keyed on the per-hook secret you set when creating the hook, and sends the digest base64-encoded in the X-Picqer-Signature header. Pass the raw body (never re-serialized JSON) and compare timing-safe.

Important: The secret is optional at hook creation. If you create a hook without a secret, Picqer sends header and signature verification is impossible. Always set a secret so requests can be verified.