quoter-webhooks

name	quoter-webhooks
description	Receive and verify Quoter webhooks. Use when setting up Quoter webhook handlers, debugging the MD5 hash verification, or handling Quote, Person, and Payment create/update events posted as x-www-form-urlencoded.
license	MIT
metadata	{"author":"hookdeck","version":"0.1.0","repository":"https://github.com/hookdeck/webhook-skills"}

Quoter Webhooks

When to Use This Skill

• Setting up Quoter webhook handlers
• Debugging Quoter hash verification failures
• Understanding Quoter object types (Quote, Person, Payment) and create vs update
• Parsing the application/x-www-form-urlencoded hash / timestamp / data payload

⚠️ Security Warning: Weak Verification Scheme

Quoter does not use HMAC-SHA256, and it is not Standard Webhooks. It uses a legacy MD5 shared-secret hash, and the hash key is optional — a Quoter webhook can be configured with no verification at all.

• The signature is a form field named hash, not an HTTP header.
• Always set a hash key in Quoter (Settings → Integrations). Without one, anyone who learns your endpoint URL can forge requests.