mailchimp-webhooks

name	mailchimp-webhooks
description	Receive and secure Mailchimp webhooks. Use when setting up Mailchimp webhook handlers, responding to Mailchimp's GET URL validation, securing the endpoint with a URL secret, or handling audience events like subscribe, unsubscribe, profile, upemail, cleaned, and campaign.
license	MIT
metadata	{"author":"hookdeck","version":"0.1.0","repository":"https://github.com/hookdeck/webhook-skills"}

Mailchimp Webhooks

When to Use This Skill

• Setting up Mailchimp webhook handlers
• How do I respond to Mailchimp's webhook URL validation (the GET request)?
• How do I secure Mailchimp webhooks (they are not HMAC-signed)?
• Handling audience events: subscribe, unsubscribe, profile, upemail, cleaned, campaign
• Parsing Mailchimp's application/x-www-form-urlencoded payloads

Verification (core)

Mailchimp does NOT sign its webhooks — there is no HMAC and no signature header. You secure the endpoint two ways, both described in Mailchimp's sync audience data with webhooks guide:

1. URL validation (GET): When you save a webhook, Mailchimp sends a GET to the URL to confirm it is reachable. Respond 200 — do not require the secret on GET.
2. Shared secret (POST): Put an unguessable secret in the webhook URL's query string (e.g. ) and compare it on every with a comparison. Always serve the endpoint over HTTPS.