zerohash-webhooks

name	zerohash-webhooks
description	Receive and verify Zero Hash webhooks. Use when setting up Zero Hash webhook handlers, debugging x-zh-hook-signature verification, or handling crypto settlement, payment, and balance events like trade_status_changed and payment_status_changed.
license	MIT
metadata	{"author":"hookdeck","version":"0.1.0","repository":"https://github.com/hookdeck/webhook-skills"}

Zero Hash Webhooks

When to Use This Skill

• How do I receive Zero Hash webhooks?
• How do I verify Zero Hash webhook signatures (x-zh-hook-signature)?
• How do I handle trade_status_changed and payment_status_changed events?
• Why is my Zero Hash webhook signature verification failing?
• How do I guard Zero Hash webhooks against replay attacks with x-zh-hook-timestamp?

Verification (core)

Zero Hash signs the raw request body with HMAC-SHA256 and sends the digest as a hex string. There is no webhook SDK — verify manually.

The recommended (replay-protected) scheme signs payload + timestamp (concatenated raw strings, no delimiter) and sends:

• x-zh-hook-signature — to_hex(hmac_sha256(payload + timestamp, secret))
• — the UNIX timestamp that was signed