Webhook Integration Builder

Webhook receivers look simple and fail in quiet ways. A JSON parser changes the bytes so signatures never match, and someone turns verification off. Retries send the same receipt twice. A late retry rolls an order back. A slow handler gets the endpoint disabled.

This skill gives your AI a procedure for doing it properly in your own codebase, in any language or framework. It pins down the provider's signature scheme from its docs, designs the flow with you, then builds it: raw-body capture with notes for a dozen frameworks, HMAC verification with a constant-time compare and timestamp tolerance, stored event ids under a unique constraint, a fast 2xx with the work in a background worker, retries with backoff, out-of-order handling, dead-lettering, key rotation, and logging that leaves out payloads and keys.

Inside: notes on six common signature schemes, a 31-item security checklist, a 24-case test plan, a provider profile template, and a Node.js script (no dependencies) that signs a payload file with a shared test key so you can send valid, tampered and replayed requests to your own receiver. It can also check a captured signature. Examples include a deliberately flawed receiver with its review, and a full walk-through.

The script covers HMAC schemes only, makes no network calls and never prints the key. The skill doesn't host endpoints or register webhooks for you.