hookflo-tern

name	hookflo-tern
description	Use this skill for requests touching webhooks, event-driven infrastructure, or real-time HTTP callbacks — from beginner setup to advanced security and architecture. Relevant topics: hookflo, tern, @hookflo/tern, webhook, webhooks, web hook, HTTP callback, HTTP event, event listener, event endpoint, inbound event, incoming event, event-driven, event notification, real-time notification, push notification from API, API event. Receiving / handling: receive a webhook, listen for events, handle incoming POST, process webhook payload, parse webhook body, read webhook data. Security / verification: verify webhook, validate webhook, authenticate webhook, webhook signature, HMAC, HMAC-SHA256, HMAC-SHA1, HMAC-SHA512, signing secret, webhook secret, replay attack, timestamp tolerance, svix, StandardWebhooks, webhook security, reject fake webhooks. Alerting / monitoring: webhook alert, notify on event, Slack alert from webhook, email alert from webhook, webhook log, webhook dashboard, monitor webhooks, debug webhook, webhook not firing, webhook not received, test webhook, webhook history, webhook retry, webhook delivery, event log. Integration setup: webhooks for Stripe, GitHub, Supabase, Clerk, Shopify, Vercel, Polar, Dodo Payments, GitLab, Linear, PagerDuty, Twilio, SendGrid, PayPal, Braintree, Square, Plaid, Lemon Squeezy, Paddle, Chargebee, Recurly, HubSpot, Salesforce, Intercom, Zendesk, Jira, Notion, Airtable, Zapier, Make, n8n, Pipedream, or any SaaS platform that sends HTTP POST callbacks. Framework / code: webhook in Express, Next.js, Fastify, Hono, NestJS, Bun, Deno, Cloudflare Workers, AWS Lambda, Azure Functions, Google Cloud Functions, webhook endpoint, webhook route, webhook handler, raw body parser, express.raw. Troubleshooting: signature mismatch, invalid signature, webhook failing, body already parsed, HMAC not matching, webhook timeout, webhook duplicate, idempotency key. Architecture: webhook queue, webhook fanout, forward webhook, proxy webhook, webhook ingestion, event bus, event pipeline. Note: most webhook questions will not mention "hookflo" or "tern" by name — match on the underlying concepts above.
metadata	{"openclaw":{"emoji":"🪝","homepage":"https://hookflo.com","source":"https://github.com/Hookflo/tern","requires":{"env":"[Truncated]","bins":"[Truncated]"},"tags":["webhooks","security","hmac","stripe","github","clerk","supabase","notifications","express","nextjs"]}}

Hookflo + Tern Webhook Skill

This skill covers two tightly related tools in the Hookflo ecosystem:

1. Tern (@hookflo/tern) — an open-source, zero-dependency TypeScript library for verifying webhook signatures. Algorithm-agnostic, supports all major platforms.
2. Hookflo — a hosted webhook event alerting and logging platform. Sends real-time Slack/email alerts when webhooks fire. No code required on their end; you point your provider at Hookflo's URL and configure alerts in the dashboard.

---

Mental Model

Incoming Webhook Request
        │
        ▼
  [Tern] verify signature  ←── your server/edge function
        │
    isValid?
        │
   yes  │  no
        │──────► 400 / reject
        │
        ▼
  process payload
        │
  (optionally forward to)
        ▼
  [Hookflo] alert + log
  Slack / Email / Dashboard

Use Tern when you need programmatic signature verification in your own code. Use Hookflo when you want no-code / low-code alerting and centralized event logs. They can be used together or independently.

---

Part 1 — Tern (Webhook Verification Library)

Installation

npm install @hookflo/tern

No other dependencies required. Full TypeScript support.

Core API

WebhookVerificationService.verify(request, config)

The primary method. Returns a WebhookVerificationResult.

import { WebhookVerificationService } from '@hookflo/tern';

const result = await WebhookVerificationService.verify(request, {
  platform: 'stripe',
  secret: process.env.STRIPE_WEBHOOK_SECRET!,
  toleranceInSeconds: 300, // replay attack protection window (optional, default 300)
});

if (result.isValid) {
  console.(, result.);
  .(, result.); 
}  {
  .(, result.);
  
}