Phil Leggetter Phil Leggetter Gareth Wilson Gareth Wilson

Introducing Webhook Skills: Your AI Agent Now Understands Webhooks

Published

Article image

When you're integrating webhooks from a new API platform or SaaS and ask your AI coding agent to set up the webhook, the code it generates often looks reasonable—until you actually run it. Then you find things like the signature verification fails or the raw body handling is wrong.

Today we're releasing webhook-skills, an open-source project that gives AI coding agents the knowledge to implement webhook integrations correctly the first time.

Why We Built Webhook Skills

This started from experience. We process billions of webhooks a week at Hookdeck, and we've seen every failure mode: signature mismatches from body parsing middleware, idempotency bugs that process the same event twice, framework-specific gotchas that only surface in prod.

We've also noticed that AI coding agents tend to struggle with webhook integrations. The training data gets stale quickly—API versions change, security best practices evolve, and the subtle implementation details that matter (like raw body handling or middleware ordering) shift between provider updates.

Research from PostHog on LLM code generation found that the most reliable way to get correct code isn't through the model's general knowledge—it's by providing specific, known-working examples that the model can reference directly.

That's what webhook-skills does. Instead of hoping the agent's training data is current, we give it concrete examples of webhook handlers that we know work, for the providers and frameworks developers actually use.

What Webhook Skills Does

webhook-skills is built on the Agent Skills specification, an open standard for packaging knowledge that AI coding agents can consume. The core principle: agents generate more reliable code when they can reference working examples rather than reconstructing patterns from training data.

Here's what that means in practice:

  • Runnable examples that are complete, minimal apps agents can test and iterate on. This gives agents working code to reference, not just snippets or descriptions.
  • Provider-specific guidance for Stripe, Shopify, GitHub, and others that handles the gotchas we commonly see trip up developers (like Stripe's raw body requirement or Shopify's HMAC encoding).
  • Framework-aware implementations that account for how Next.js, Express, FastAPI, and other frameworks handle request bodies, middleware ordering, and async patterns.
  • Staged workflows that guide agents through the correct sequence: verify signature first, parse payload second, handle idempotently third.

When you install webhook-skills and ask your agent to "set up Stripe webhooks in my Next.js app," it doesn't hallucinate a generic handler. It knows that Next.js App Router requires specific body handling, that the raw body must be preserved before verification, and that the webhook secret should come from environment variables with a specific naming convention.

Why the Agent Skills Format Matters

Skills are still evolving. Vercel's recent evaluation of agent instruction formats showed that while AGENTS.md performed better in their specific benchmarks, both approaches dramatically outperform relying on base model knowledge alone. The real win comes from giving agents any structured, domain-specific context.

As more projects adopt the skills format, we'll see consistency improve across the ecosystem. An agent that knows how to consume one skill can consume them all. That network effect makes the entire agent coding experience more reliable.

We chose skills because it's an open spec designed specifically for this use case, and we believe standardization will benefit developers more than fragmented, tool-specific formats.

Getting Started

Install skills using npx skills:

# List available skills
npx skills add hookdeck/webhook-skills --list

# Install best-practice patterns (recommended: verify → parse → handle idempotently)
npx skills add hookdeck/webhook-skills --skill webhook-handler-patterns

# Install specific provider skills
npx skills add hookdeck/webhook-skills --skill stripe-webhooks
npx skills add hookdeck/webhook-skills --skill shopify-webhooks

For local webhook development, install the Hookdeck CLI; it provides the hookdeck listen command that tunnels to your localhost:

# Install the Hookdeck CLI
npm i -g hookdeck-cli

# or:
brew install hookdeck/hookdeck/hookdeck

# Start local tunnel (no account required)
hookdeck listen 3000 --path /webhooks/stripe

This gives you a public URL that forwards to your local server, plus a web UI for inspecting and replaying requests.

Once installed, your agent has access to webhook knowledge for supported providers. Just prompt naturally — e.g., "add Shopify webhook handling to my Express app."

What's Included

At launch, webhook-skills covers the providers and frameworks we see most often:

Providers: Stripe, Shopify, GitHub, OpenAI, Resend, Paddle, ElevenLabs, Chargebee, and more.

Frameworks: Next.js, Express, and FastAPI.

Each provider skill includes signature verification patterns, recommended event handling approaches, common failure modes and how to avoid them, and testing strategies for local development.

Built for the Community

We're releasing webhook-skills as an open-source community resource. The skills content is useful regardless of what webhook infrastructure you use. If you're already using hookdeck listen for local webhook development, the skills complement that workflow, but they're valuable on their own.

We're also inviting API platforms to contribute their own provider skills. If you maintain a webhook-producing API and want your webhooks to "just work" with AI coding agents, we'd love to collaborate. Open an issue or PR on the repository.

What's Next

We're planning to expand provider coverage based on community demand, add more framework-specific implementations, and iterate on the skill format as the agent ecosystem evolves.

If you've ever lost an afternoon to webhook signature verification failures, give webhook-skills a try. Your AI agent might finally understand what you're really asking for.



Links:


Have feedback or want to contribute a provider? Open an issue on GitHub.


You are subscribed.
An error occured submitting the form. Please try again or email info@hookdeck.com