Loading...
Loading...
Receive inbound webhooks from external services (Stripe, GitHub, Slack, Twilio, etc.) using `api.raw(...)` from `encore.dev/api`. The right skill any time the user names a third-party provider that POSTs events to a URL you own.
npx skill4agent add encoredev/skills encore-webhookapi.raw(...)import { api } from "encore.dev/api";api.rawexport const stripeWebhook = api.raw(
{ expose: true, path: "/webhooks/stripe", method: "POST" },
async (req, res) => {
const sig = req.headers["stripe-signature"];
// Read raw body
const chunks: Buffer[] = [];
for await (const chunk of req) chunks.push(chunk);
const rawBody = Buffer.concat(chunks).toString("utf8");
// Verify signature, parse event...
res.writeHead(200, { "Content-Type": "application/json" });
res.end(JSON.stringify({ received: true }));
}
);secret(...)encore.dev/configencore-secretimport { secret } from "encore.dev/config";
const stripeWebhookSecret = secret("StripeWebhookSecret");
// inside handler:
import Stripe from "stripe";
const stripe = new Stripe(stripeApiKey());
const event = stripe.webhooks.constructEvent(rawBody, sig, stripeWebhookSecret());X-Hub-Signature-256| Provider | Signature header | Verification |
|---|---|---|
| Stripe | | |
| GitHub | | HMAC-SHA256 over the raw body |
| Slack | | HMAC-SHA256 over |
| Shopify | | HMAC-SHA256 (base64) over the raw body |
| Twilio | | HMAC-SHA1 over URL + sorted form fields |
encore-pubsubimport { Topic } from "encore.dev/pubsub";
interface StripeEvent { id: string; type: string; data: unknown; }
const stripeEvents = new Topic<StripeEvent>("stripe-events", {
deliveryGuarantee: "at-least-once",
});
// inside the raw handler, after verification:
await stripeEvents.publish({ id: event.id, type: event.type, data: event.data });
res.writeHead(200); res.end();api.rawsecret(...)api(...)encore-api