secure webhook automation builder
Architect production-ready webhook handlers with signature verification, idempotency, and failure recovery logic.
$5
Works with the AI Agents you already use
Claude Code
Cursor
Codex CLI
Muse
Dots+21 moreClaude CodeCursorCodex CLIMuseDots
Manus
Grok
Grok Bot+18 agentssecure webhook automation builder
Example session with this skill installed
I need a webhook handler for Stripe 'checkout.session.completed' events to provision a SaaS seat in my PostgreSQL DB and send a Slack alert. I'm using Node.js and Hmac verification.
- Read your context and instructions
- Compiled the secure webhook automation
I have designed the webhook workflow for your Stripe to SaaS provisioning sync. This architecture ensures that seats are not double-allocated and that Slack failures do not block database transactions.
Webhook Architecture Blueprint
| Component | Specification |
|---|---|
| Source Event | Stripe checkout.session.completed |
| Security | HMAC-SHA256 signature verification using stripe-signature header and endpoint secret. |
| Payload Contract | Validate id (Session ID), customer, and client_reference_id (Internal User ID). |
| Idempotency | Use evt_id from Stripe as a unique constraint in a processed_webhooks table. |
| Primary Action | Upsert user seat in PostgreSQL using client_reference_id. |
| Secondary Action | Post to Slack Incoming Webhook (Fire-and-forget or async queue). |
Logic & Security Checks
// Verification Logic
const event = stripe.webhooks.constructEvent(payload, sig, endpointSecret);
// Idempotency Logic
// 1. Check if event.id exists in 'processed_events' table.
// 2. If exists, return 200 OK (already processed).
// 3. If not, begin DB transaction.
Failure & Retry Plan
- Database Conflict: If seat is already active, log warning and return 200 to prevent Stripe retries.
- Slack Timeout: Wrap Slack call in a try-catch. Do not roll back the DB transaction if only Slack fails.
- Stripe Retries: Handler must be idempotent to support Stripe's 72-hour retry schedule.
Test Matrix
- Success: Valid signature, new session ID -> Seat created, Slack sent.
- Duplicate: Valid signature, existing session ID -> No DB change, return 200.
- Spoofing: Invalid signature -> Return 400, log security alert.
- Partial Failure: DB success, Slack 500 -> Return 200 (seat is safe), log Slack error.
Next steps
- Create the
processed_webhookstable in PostgreSQL to store Stripe event IDs. - Implement the
stripe.webhooks.constructEventcheck using your secret key. - Configure the Slack notification to run as an asynchronous background task.
Connects securely to your tools. The creator never sees your data.
About this skill
Webhooks are the glue of modern software, but most implementations fail at scale due to missing idempotency, weak security, or blind retries. This skill provides a structured blueprint for building production-ready webhook handlers that don't break your database or leak data.
What it does
- Event Contracts defines strict payload schemas and business meanings for incoming data.
- Security Verification designs signature validation and authenticity checks to prevent spoofing.
- Idempotency Logic maps stable identifiers to prevent duplicate processing of the same event.
- Error Handling establishes retry strategies, partial-failure behaviors, and fallback plans.
- Observability Design specifies structured logging, monitoring, and replay safety requirements.
How it works
- Define Event Scope by providing the source system, destination, and payload fields.
- Establish Security by mapping out signature verification and validation rules.
- Map Logic to define transformations, side effects, and deduplication strategies.
- Finalize Operations with a full test matrix and monitoring plan for the production environment.
Frameworks & tools
Works with any backend stack including Node.js, Python, Go, and serverless platforms like AWS Lambda or Vercel. Applicable to providers like Stripe, Shopify, GitHub, and custom SaaS webhooks.
Why this beats prompting it yourself
Generic prompts often ignore critical failure modes like race conditions or duplicate deliveries. This skill enforces a rigorous architectural checklist including idempotency and signature verification that developers frequently overlook.
Use cases
- Designing a Stripe payment handler that prevents double-fulfillment of orders.
- Building a CRM lead sync that handles API rate limits with graceful retries.
- Creating a GitHub app integration that verifies payloads before executing CI workflows.
- Architecting a subscription management system that reconciles missed events.
Known limitations
Does not provide specific boilerplate code for every language; focuses on the logic, schema, and architectural contract. Requires the user to provide the specific source system for accurate security rules.
Does not generate executable code for all languages. Requires specific source/destination details for high-fidelity mapping. Focuses on architecture over implementation boilerplate.
How to use
- 1
Connect your agent to the Agensi MCP
Copy the prompt and paste it into Claude, ChatGPT, Cursor or any agent that supports MCP. It sets up the connection for you. Manual setup
- 2
Sign in to Agensi
Your agent shows a sign-in link. Sign in and click Allow.
- 3
Ask for what you need
Your agent loads this skill and uses it on your task. It always asks before any payment.
Reviews
No reviews yet
Be one of the first to try it. Every listed skill goes through the trust checks below.
Security scanned
Checked by our 8-point scan before listing
Fresh listing
Recently published to Agensi
Money-back guarantee
Doesn't do what its page promises? You get your money back.
Trust & safety
Security scan
Security scan passed 1 month ago
Permissions
No special permissions declared or detected