Dub Webhooks Skill

Receive Dub link, lead, sale and partner events.

When to Use This Skill

• Configure a receiver for Dub webhook deliveries.
• Diagnose dub-signature verification failures.
• Handle link.created, lead.created, sale.created.

Setup

Create a webhook in Dub and copy its signing secret from the webhook's Configuration tab. Keep the entire whsec_ prefix and the rest of the secret unchanged.

Paste the whole secret, including the whsec_ prefix. Dub uses it as a plain HMAC key.

Set DUB_WEBHOOK_SECRET in the server environment. Read setup before enabling delivery.

Verification (core)

dub-signature contains a bare hex digest over the raw body. Use HMAC-SHA256 with the secret's UTF-8 bytes. Verify the original bytes before parsing JSON. Validate the digest format, then compare equal-length buffers in constant time.

After extracting the documented digest and constructing message as described in verification, the comparison is:

const expected = crypto.createHmac('sha256', secret).update(message).digest();
if (digest.length !== 64 || !/^[0-9a-fA-F]{64}$/.test(digest)) return false;
const received = Buffer.from(digest, 'hex');
return received.length === expected.length && crypto.timingSafeEqual(received, expected);

No timestamp is included in the signed message. These examples do not invent an age check from unsigned fields.

Complete handlers and tests: Express, Next.js, FastAPI.

Event Handling

The envelope contains id, event, createdAt and data. Dub uses the entire whsec_ string as a UTF-8 HMAC key. Do not strip the prefix or decode the remainder; this scheme does not use the Standard Webhooks signing format.

Acknowledge accepted events promptly and make changes idempotent using the delivery id. Store secrets only on the server.

Local Development

npx hookdeck-cli listen 3000 dub --path /webhooks/dub

Use port 8000 for FastAPI. The CLI provides a local tunnel and inspection UI; no account is required to start.

Resources

• Overview and event routing
• Endpoint and secret setup
• Verification and troubleshooting