Agent Skills

webhook-handler-patterns

Best practices for webhook handlers. Use when implementing the handler sequence (verify first, parse second, handle idempotently), idempotency, error handling, retry logic, or framework-specific issues with Express, Next.js, or FastAPI.

Install

npx skills add https://github.com/hookdeck/webhook-skills --skill webhook-handler-patterns
SKILL.md

Webhook Handler Patterns

When to Use This Skill

  • Following the correct webhook handler order (verify → parse → handle idempotently)
  • Implementing idempotent webhook handlers
  • Handling errors and configuring retry behavior
  • Understanding framework-specific gotchas (raw body, middleware order)
  • Building production-ready webhook infrastructure

Resources

Handler Sequence

Best Practices

Framework Guides

Quick Reference

Handler Sequence

  1. Verify signature first — Use raw body; reject invalid requests with 4xx.
  2. Parse payload second — After verification, parse or construct the event.
  3. Handle idempotently third — Check event ID, then process; return 2xx for duplicates.

See references/handler-sequence.md for details and links to provider verification and idempotency patterns.

Response Codes

Code Meaning Provider Behavior
2xx Success No retry
4xx Client error Usually no retry (except 429)
5xx Server error Retry with backoff
429 Rate limited Retry after delay

Idempotency Checklist

  1. Extract unique event ID from payload
  2. Check if event was already processed
  3. Process event within transaction
  4. Store event ID after successful processing
  5. Return success for duplicate events

Related Skills

Related skills

entra-app-registrationmicrosoft606KGuides Microsoft Entra ID app registration, OAuth 2.0 authentication, and MSAL integration. USE FOR: create app registration, register Azure AD app, configure OAuth, set up authentication, add API permissions, generate service principal, MSAL example, console app auth, Entra ID setup, Azure AD authentication. DO NOT USE FOR: Key Vault secrets (use azure-keyvault-expiration-audit), general Azure resource security guidance.azure-messagingmicrosoft595KTroubleshoot and resolve issues with Azure Messaging SDKs for Event Hubs and Service Bus. Covers connection failures, authentication errors, message processing issues, and SDK configuration problems. WHEN: event hub SDK error, service bus SDK issue, messaging connection failure, AMQP error, event processor host issue, message lock lost, message lock expired, lock renewal, lock renewal batch, send timeout, receiver disconnected, SDK troubleshooting, azure messaging SDK, event hub consumer, servicentra-agent-idmicrosoft328KProvision Microsoft Entra Agent Identity Blueprints, BlueprintPrincipals, and per-instance Agent Identities via Microsoft Graph, and configure OAuth 2.0 token exchange (fmi_path, OBO, cross-tenant) including the Microsoft Entra SDK for AgentID sidecar. USE FOR: Agent Identity Blueprint, BlueprintPrincipal, agent OAuth, fmi_path token exchange, agent OBO, Workload Identity Federation for agents, polyglot agent auth, Microsoft.Identity.Web.AgentIdentities. DO NOT USE FOR: standard Entra app registsupabasesupabase298KUse when doing ANY task involving Supabase. Triggers: Supabase products (Database, Auth, Edge Functions, Realtime, Storage, Vectors, Cron, Queues); client libraries and SSR integrations (supabase-js, @supabase/ssr) in Next.js, React, SvelteKit, Astro, Remix; auth issues (login, logout, sessions, JWT, cookies, getSession, getUser, getClaims, RLS); Supabase CLI or MCP server; schema changes, migrations, declarative schemas, security audits, Postgres extensions (pg_graphql, pg_cron, pg_vector); deb

Search skills and MCP servers

Fuzzy search across 23,137 skills and servers