pipedrive-webhooks

name	pipedrive-webhooks
description	Receive and authenticate Pipedrive webhooks. Use when setting up Pipedrive webhook handlers, debugging HTTP Basic Auth verification, or handling CRM events like create.deal, change.person, or delete.activity.
license	MIT
metadata	{"author":"hookdeck","version":"0.1.0","repository":"https://github.com/hookdeck/webhook-skills"}

Pipedrive Webhooks

When to Use This Skill

• How do I receive Pipedrive webhooks?
• How do I authenticate Pipedrive webhook deliveries?
• How do I handle create.deal, change.person, or delete.activity events?
• Why is my Pipedrive webhook returning 401 / getting banned?
• How do I create a Pipedrive webhook (v2) via the API?

Verification (core)

Pipedrive does NOT sign webhooks. There is no HMAC, no signature header, and it is not Standard Webhooks compliant. Security is HTTP Basic Auth: you set http_auth_user / http_auth_password when creating the webhook, and Pipedrive sends them in the standard Authorization: Basic <base64(user:pass)> header on every delivery. Your endpoint must be HTTPS (self-signed certs are not supported). Verify the credentials with a timing-safe comparison:

const crypto = ();

 () {
   ab = .(a, );
   bb = .(b, );
  
   ab. === bb. && crypto.(ab, bb);
}

 () {
   (!authHeader || !authHeader.())  ;
   decoded = .(authHeader.(), ).();
   sep = decoded.();                 
   (sep === -)  ;
   (decoded.(, sep), user) && (decoded.(sep + ), pass);
}