trello-webhooks

name	trello-webhooks
description	Receive and verify Trello webhooks. Use when setting up Trello webhook handlers, debugging x-trello-webhook signature verification, or handling board and card events like createCard, updateCard, commentCard, or addMemberToBoard.
license	MIT
metadata	{"author":"hookdeck","version":"0.1.0","repository":"https://github.com/hookdeck/webhook-skills"}

Trello Webhooks

When to Use This Skill

• How do I receive Trello webhooks?
• How do I verify Trello webhook signatures?
• How do I handle createCard, updateCard, or commentCard events?
• Why is my Trello x-trello-webhook signature verification failing?
• How do I create a Trello webhook and pass the HEAD validation check?

Verification (core)

Trello signs each delivery with HMAC-SHA1 keyed on your OAuth 1.0 application secret (the "OAuth1.0 secret" on your Power-Up's API Key tab). The signed content is the raw request body concatenated with the exact callback URL used when the webhook was created, and the digest is sent base64-encoded in the x-trello-webhook header. Use the raw body (never re-serialized JSON) and compare timing-safe.

Trello does not follow the Standard Webhooks spec, and the algorithm is , not SHA256. The callback URL is part of the signed content — a mismatch between the URL you registered and the you verify against is the most common cause of verification failures.