| name | shipbob-webhooks |
| description | Receive and verify ShipBob webhooks. Use when setting up ShipBob webhook handlers, debugging signature verification, or handling fulfillment events like order.shipped, order.shipment.delivered, order.shipment.tracking.updated, return.created, wro.created, or billing.charge.created.
|
| license | MIT |
| metadata | {"author":"hookdeck","version":"0.1.0","repository":"https://github.com/hookdeck/webhook-skills"} |
ShipBob Webhooks
When to Use This Skill
- Setting up ShipBob webhook handlers
- Debugging ShipBob signature verification failures
- Understanding ShipBob event types (topics) and payloads
- Handling fulfillment, shipment, return, receiving (WRO), or billing events
Verification (core)
ShipBob signs webhooks with the Standard Webhooks
scheme (the same fields Svix uses). It sends three headers — webhook-id,
webhook-timestamp, and webhook-signature — and the event topic in a
separate x-webhook-topic header (e.g. order.shipped).
The signature is HMAC-SHA256(secret, "{webhook-id}.{webhook-timestamp}.{body}"),
base64-encoded. The signing secret is whsec_<base64> — strip the whsec_
prefix and base64-decode the remainder to get the raw HMAC key. Always verify
against the request body (don't first).
holds space-delimited versioned signatures ();
compare against the entry with a timing-safe comparison.
