attentive-webhooks

name	attentive-webhooks
description	Receive and verify Attentive webhooks. Use when setting up Attentive webhook handlers, debugging signature verification (x-attentive-hmac-sha256), or handling SMS and email events like sms.subscribed, sms.unsubscribed, email.opened, or custom_attribute.set.
license	MIT
metadata	{"author":"hookdeck","version":"0.1.0","repository":"https://github.com/hookdeck/webhook-skills"}

Attentive Webhooks

When to Use This Skill

• How do I receive Attentive webhooks?
• How do I verify Attentive webhook signatures?
• Why is my x-attentive-hmac-sha256 signature verification failing?
• How do I handle sms.subscribed, sms.unsubscribed, or email.opened events?
• Understanding Attentive event types and payloads

Verification (core)

Attentive signs the raw request body with HMAC-SHA256 keyed on your per-webhook signing key (called the "client secret" in the dashboard) and sends the digest, hex-encoded, in the x-attentive-hmac-sha256 header. There is no timestamp in the signature (Attentive does not use the Standard Webhooks scheme), so compute the HMAC over the exact raw body and compare timing-safe. There is no official server-side SDK, so verify manually.

Node:

 crypto = ();

 () {
   (!signatureHeader)  ;
   expected = crypto.(, secret).(rawBody).();
   {
     crypto.(
      .(signatureHeader, ),
      .(expected, )
    );
  }  {
     ; 
  }
}