synctera-webhooks

name	synctera-webhooks
description	Receive and verify Synctera webhooks. Use when setting up Synctera webhook handlers, debugging Synctera-Signature verification, or handling banking events like ACCOUNT.UPDATED or TRANSACTIONS.POSTED.CREATED.
license	MIT
metadata	{"author":"hookdeck","version":"0.1.0","repository":"https://github.com/hookdeck/webhook-skills"}

Synctera Webhooks

When to Use This Skill

• How do I receive Synctera webhooks?
• How do I verify Synctera webhook signatures (Synctera-Signature)?
• How do I handle ACCOUNT.UPDATED or TRANSACTIONS.POSTED.CREATED events?
• Why is my Synctera webhook signature verification failing?
• How do I generate a Synctera webhook signing secret?

Verification (core)

Synctera uses a custom HMAC scheme (not Standard Webhooks). Each delivery has two headers:

• Synctera-Signature — the hex-encoded signature (two .-delimited signatures during secret rotation)
• Request-Timestamp — POSIX seconds used in the signed string

The signed string is `${Request-Timestamp}.${raw_body}` (the . is a literal separator). Compute HMAC-SHA256(secret, signed_string) and hex-encode. The secret is your API key — generate it with (empty body) and store it. Verify against the body; don't first.