| name | twitter-webhooks |
| description | Receive and verify Twitter/X Account Activity API webhooks. Use when setting up X (Twitter) webhook handlers, debugging the x-twitter-webhooks-signature HMAC-SHA256 check, answering the CRC (Challenge-Response Check) crc_token request, or handling events like tweet_create_events, favorite_events, follow_events, and direct_message_events.
|
| license | MIT |
| metadata | {"author":"hookdeck","version":"0.1.0","repository":"https://github.com/hookdeck/webhook-skills"} |
Twitter / X Webhooks
Twitter/X delivers account activity through the Account Activity API. Your
public HTTPS endpoint must do two things:
- Answer the CRC (Challenge-Response Check) — X sends a
GET request with a
crc_token query parameter at registration, roughly hourly, and on demand.
You must reply within the timeout with a response_token, or the webhook is
marked invalid and delivery stops.
- Verify POST deliveries — every event
POST carries an
x-twitter-webhooks-signature header you validate before processing.
Both use the same primitive: HMAC-SHA256 keyed with your app's consumer
secret (API secret key), base64-encoded, prefixed with sha256=. Use the
consumer secret — not the bearer token or user access token.
When to Use This Skill
