shipbob-webhooks

name	shipbob-webhooks
description	Receive and verify ShipBob webhooks. Use when setting up ShipBob webhook handlers, debugging signature verification, or handling fulfillment events like order.shipped, order.shipment.delivered, order.shipment.tracking.updated, return.created, wro.created, or billing.charge.created.
license	MIT
metadata	{"author":"hookdeck","version":"0.1.0","repository":"https://github.com/hookdeck/webhook-skills"}

ShipBob Webhooks

When to Use This Skill

• Setting up ShipBob webhook handlers
• Debugging ShipBob signature verification failures
• Understanding ShipBob event types (topics) and payloads
• Handling fulfillment, shipment, return, receiving (WRO), or billing events

Verification (core)

ShipBob signs webhooks with the Standard Webhooks scheme (the same fields Svix uses). It sends three headers — webhook-id, webhook-timestamp, and webhook-signature — and the event topic in a separate x-webhook-topic header (e.g. order.shipped).

The signature is HMAC-SHA256(secret, "{webhook-id}.{webhook-timestamp}.{body}"), base64-encoded. The signing secret is whsec_<base64> — strip the whsec_ prefix and base64-decode the remainder to get the raw HMAC key. Always verify against the request body (don't first). holds space-delimited versioned signatures (); compare against the entry with a timing-safe comparison.