courier-webhooks

name	courier-webhooks
description	Receive and verify Courier outbound webhooks. Use when setting up Courier webhook handlers, debugging courier-signature verification, or handling notification and audience events like message:updated, notification:submitted, or audiences:updated.
license	MIT
metadata	{"author":"hookdeck","version":"0.1.0","repository":"https://github.com/hookdeck/webhook-skills"}

Courier Webhooks

When to Use This Skill

• How do I receive Courier outbound webhooks?
• How do I verify the Courier courier-signature header?
• How do I handle message:updated status changes or notification:submitted events?
• Why is my Courier webhook signature verification failing?

Verification (core)

Courier signs every outbound webhook with HMAC-SHA256. The courier-signature header carries a timestamp and hex signature: t=<timestamp>,signature=<hex_digest>. The signed content is `${timestamp}.${rawBody}` — the timestamp, a literal dot, then the raw request body (do not JSON.parse before verifying). Courier has no webhook-verification SDK, so verify manually and compare in constant time.

Courier does not document whether t is in seconds or milliseconds, so normalize it before the staleness comparison instead of assuming a unit. The 5-minute tolerance below is this skill's default, not a window Courier publishes — tune it to your needs.