statsig-webhooks

name	statsig-webhooks
description	Receive and verify Statsig Event Webhook (Generic Webhook) requests. Use when setting up a Statsig webhook handler, debugging Statsig signature verification, or processing exposure events and config-change notifications (feature gates, experiments, dynamic configs).
license	MIT
metadata	{"author":"hookdeck","version":"0.1.0","repository":"https://github.com/hookdeck/webhook-skills"}

Statsig Webhooks

When to Use This Skill

• Setting up a Statsig Event Webhook (the "Generic Webhook" integration)
• Debugging X-Statsig-Signature verification failures
• Processing exposure events or config-change notifications (feature gate, experiment, or dynamic config created / updated events)
• Handling Statsig's JSON batch payloads (arrays) and the config-change { "data": [...] } envelope

Essential Code (USE THIS)

Statsig signs every webhook request with HMAC-SHA256 using a Slack/Stripe-style scheme (this is not the Standard Webhooks spec). The signed content is the literal string v0:{timestamp}:{raw_body}, and the result is sent as X-Statsig-Signature: v0=<hex>. Use the raw request body — parsing JSON before verifying will change byte ordering and break the signature.