recurly-webhooks

name	recurly-webhooks
description	Receive and verify Recurly webhooks. Use when setting up Recurly webhook handlers, verifying the recurly-signature header (HMAC-SHA256), securing the endpoint with HTTP Basic Auth, or handling subscription and billing events like new_subscription_notification, updated_subscription_notification, successful_payment_notification, and failed_payment_notification.
license	MIT
metadata	{"author":"hookdeck","version":"0.1.0","repository":"https://github.com/hookdeck/webhook-skills"}

Recurly Webhooks

When to Use This Skill

• How do I receive Recurly webhooks?
• How do I verify the Recurly recurly-signature header?
• How do I secure a Recurly webhook endpoint with HTTP Basic Auth?
• How do I handle new_subscription_notification or successful_payment_notification?
• Why is my Recurly webhook signature verification failing?

How Recurly Secures Webhooks

Recurly webhooks are secured with up to three layers. Use all that apply:

1. Signature (JSON payloads only). Recurly signs JSON notifications and sends the signature in a recurly-signature header. This is the primary integrity check — always verify it. (Legacy XML payloads are not signed.)
2. HTTP Basic Auth. Configure a username/password on the endpoint in Recurly; Recurly sends them in the header on every request.