shiphero-webhooks

name	shiphero-webhooks
description	Receive and verify ShipHero webhooks. Use when setting up ShipHero webhook handlers, debugging signature verification (x-shiphero-hmac-sha256), or handling fulfillment events like Order Allocated, Shipment Update, Inventory Update, Order Canceled, and Return Update.
license	MIT
metadata	{"author":"hookdeck","version":"0.1.0","repository":"https://github.com/hookdeck/webhook-skills"}

ShipHero Webhooks

When to Use This Skill

• How do I receive ShipHero webhooks?
• How do I verify ShipHero webhook signatures?
• How do I handle Order Allocated, Shipment Update, or Inventory Update events?
• Why is my ShipHero webhook signature verification failing?
• How do I register a ShipHero webhook with the webhook_create mutation?

Verification (core)

ShipHero signs each webhook with HMAC-SHA256 over the raw JSON request body, base64-encoded, sent in the x-shiphero-hmac-sha256 header. The key is the app's shared_signature_secret, returned once by the webhook_create mutation. Verify by recomputing base64(HMAC-SHA256(rawBody, secret)) and comparing timing-safe against the header. Pass the raw body — parsing JSON first will break the signature. This is a plain HMAC of the raw body (NOT payload-concatenated-with-account-id, NOT Standard Webhooks).