Receive and verify Bridge API webhooks (bridgeapi.io — the open-banking aggregator by Bridge/Bankin', NOT bridge.xyz). Use when setting up Bridge API webhook handlers, debugging BridgeApi-Signature HMAC-SHA256 verification, or handling events like item.created, item.refreshed, item.account.updated, payment.transaction.created, or user.deleted.
Standardmäßig ist der Prompt ausgewählt, der zuerst die Quelle prüft. Sie können zu einem direkten Befehl wechseln oder eine lokale Kopie herunterladen.
Quelldateien prüfen
Lesen Sie SKILL.md und alle von SkillsMP angezeigten Begleitdateien, bevor Sie sich für eine Installation entscheiden.
Mit Codex oder Claude installieren Kopieren Sie diesen Prompt, fügen Sie ihn in Codex, Claude oder einen anderen Assistant ein und lassen Sie die Skill-Seite prüfen und installieren.
Ein direkter Befehl überspringt den Prüf-Prompt. Prüfen Sie die Quelle, bevor Sie ihn ausführen.
Receive and verify Bridge API webhooks (bridgeapi.io — the open-banking aggregator by Bridge/Bankin', NOT bridge.xyz). Use when setting up Bridge API webhook handlers, debugging BridgeApi-Signature HMAC-SHA256 verification, or handling events like item.created, item.refreshed, item.account.updated, payment.transaction.created, or user.deleted.
Which Bridge? This skill is for Bridge API (bridgeapi.io), the
open-banking / account-aggregation platform by Bridge (formerly Bankin').
It is notbridge.xyz
(the stablecoin/crypto payments company). See
bridge-xyz-webhooks
for that one.
When to Use This Skill
How do I receive Bridge API webhooks?
How do I verify the BridgeApi-Signature header?
Why is my Bridge API webhook signature verification failing?
How do I handle item.refreshed, item.account.updated, or payment.transaction.created events?
How do I support Bridge's signing-secret rotation (two active secrets)?
Verification (core)
Bridge signs the raw request body with HMAC-SHA256, keyed on the webhook's
signing secret, and sends the digest in the BridgeApi-Signature header as one
or more scheme-prefixed, comma-separated values — hex, uppercase:
Only the v1 scheme is valid — ignore any other scheme to avoid downgrade
attacks. Multiple v1 values can appear during a secret rotation (the old
secret stays valid for 24h, up to 2 active signatures), so accept the webhook if
anyv1 value matches. Compare timing-safe over the raw body.
Node:
const crypto = require('crypto');
functionverifyBridgeWebhook(rawBody, signatureHeader, secret) {
if (!signatureHeader) returnfalse;
const expected = crypto.createHmac('sha256', secret).update(rawBody).digest('hex');
// Keep only v1= signatures (ignore other schemes → no downgrade), strip the prefixconst signatures = signatureHeader.split(',')
.map((s) => s.trim())
.filter((s) => s.startsWith('v1='))
.map((s) => s.slice(3));
if (signatures.length === 0) returnfalse;
// hex decode is case-insensitive, so Bridge's UPPERCASE hex compares cleanlyreturn signatures.some((sig) => {
try {
return crypto.timingSafeEqual(Buffer.from(sig, 'hex'), Buffer.from(expected, 'hex'));
} catch {
returnfalse; // malformed / length mismatch
}
});
}
Python:
import hmac, hashlib
defverify_bridge_webhook(raw_body: bytes, signature_header: str, secret: str) -> bool:
ifnot signature_header:
returnFalse
expected = hmac.new(secret.encode(), raw_body, hashlib.sha256).hexdigest()
signatures = [s.strip()[3:] for s in signature_header.split(",") if s.strip().startswith("v1=")]
# hex compare is case-insensitive → lowercase both sides before compare_digestreturnany(hmac.compare_digest(sig.lower(), expected.lower()) for sig in signatures)
For complete handlers with route wiring, event dispatch, and tests, see:
content fields vary by event. Expect webhooks for already-deleted users or
items — handle them defensively (a lookup miss is normal, not an error).
Important Headers
Header
Description
BridgeApi-Signature
HMAC-SHA256 signatures, v1=<UPPERCASE_HEX> (comma-separated for rotation)
Environment Variables
BRIDGE_WEBHOOK_SECRET=your_webhook_signing_secret # Shown once when the webhook is created/rotated
Source IPs
Bridge delivers from fixed IPs — optionally allowlist them (read the client IP
from X-Forwarded-For if you sit behind a proxy/load balancer):
63.32.31.5
52.215.247.62
34.249.92.209
Keep your response body under 10 KB and reply with 200 as quickly as
possible. Non-200 or slow responses are retried with exponential backoff for 1–2 days.
We recommend installing the webhook-handler-patterns skill alongside this one for handler sequence, idempotency, error handling, and retry logic. Key references (open on GitHub):
Handler sequence — Verify first, parse second, handle idempotently third
hookdeck-event-gateway - Webhook infrastructure that replaces your queue — guaranteed delivery, automatic retries, replay, rate limiting, and observability for your webhook handlers
