| name | trello-webhooks |
| description | Receive and verify Trello webhooks. Use when setting up Trello webhook handlers, debugging x-trello-webhook signature verification, or handling board and card events like createCard, updateCard, commentCard, or addMemberToBoard.
|
| license | MIT |
| metadata | {"author":"hookdeck","version":"0.1.0","repository":"https://github.com/hookdeck/webhook-skills"} |
Trello Webhooks
When to Use This Skill
- How do I receive Trello webhooks?
- How do I verify Trello webhook signatures?
- How do I handle
createCard, updateCard, or commentCard events?
- Why is my Trello
x-trello-webhook signature verification failing?
- How do I create a Trello webhook and pass the HEAD validation check?
Verification (core)
Trello signs each delivery with HMAC-SHA1 keyed on your OAuth 1.0 application
secret (the "OAuth1.0 secret" on your Power-Up's API Key tab). The signed content
is the raw request body concatenated with the exact callback URL used when the
webhook was created, and the digest is sent base64-encoded in the
x-trello-webhook header. Use the raw body (never re-serialized JSON) and compare
timing-safe.
Trello does not follow the Standard Webhooks spec, and the algorithm is
, not SHA256. The callback URL is part of the signed content — a mismatch
between the URL you registered and the you verify against is
the most common cause of verification failures.
