Receive and verify Hugging Face webhooks. Use when setting up Hugging Face webhook handlers, debugging X-Webhook-Secret verification, or handling events on models, datasets, and Spaces — repo updates, new commits and tags (repo.content), config changes (repo.config), discussions, Pull Requests, and discussion comments.
Receive and verify Hugging Face webhooks. Use when setting up Hugging Face webhook handlers, debugging X-Webhook-Secret verification, or handling events on models, datasets, and Spaces — repo updates, new commits and tags (repo.content), config changes (repo.config), discussions, Pull Requests, and discussion comments.
Handling repo events on models, datasets, and Spaces
Reacting to new commits, tags, or branches via updatedRefs
Building discussion or Pull Request bots on the Hub
Listening for comments on discussions
Auto-retraining models when a dataset is updated
Essential Code (USE THIS)
Hugging Face does not use HMAC signatures. Instead, the secret you configure in the webhook settings is sent verbatim in the X-Webhook-Secret header (or as a ?secret= query parameter). Verify with a timing-safe string comparison.
We recommend installing the webhook-handler-patterns skill alongside this one for handler sequence, idempotency, error handling, and retry logic. Key references (open on GitHub):
Handler sequence — Verify first, parse second, handle idempotently third
hookdeck-event-gateway - Webhook infrastructure that replaces your queue — guaranteed delivery, automatic retries, replay, rate limiting, and observability for your webhook handlers
