# Dub Webhooks

Receive Dub link, lead, sale and partner events.

## When to Use This Skill

* Configure a receiver for Dub webhook deliveries.
* Diagnose `dub-signature` verification failures.
* Handle `link.created`, `lead.created`, `sale.created`.

## Setup

Create a webhook in Dub and copy its signing secret from the webhook's Configuration tab. Keep the entire whsec_ prefix and the rest of the secret unchanged.

Paste the whole secret, including the whsec_ prefix. Dub uses it as a plain HMAC key.

Set `DUB_WEBHOOK_SECRET` in the server environment. Read [setup](https://github.com/hookdeck/webhook-skills/blob/main/skills/dub-webhooks/references/setup.md) before enabling delivery.

## Verification (core)

`dub-signature` contains a bare hex digest over the raw body. Use HMAC-SHA256 with the secret's UTF-8 bytes. Verify the original bytes before parsing JSON. Validate the digest format, then compare equal-length buffers in constant time.

After extracting the documented digest and constructing `message` as described in [verification](https://github.com/hookdeck/webhook-skills/blob/main/skills/dub-webhooks/references/verification.md), the comparison is:

```javascript
const expected = crypto.createHmac('sha256', secret).update(message).digest();
if (digest.length !== 64 || !/^[0-9a-fA-F]{64}$/.test(digest)) return false;
const received = Buffer.from(digest, 'hex');
return received.length === expected.length && crypto.timingSafeEqual(received, expected);

```

No timestamp is included in the signed message. These examples do not invent an age check from unsigned fields.

Complete handlers and tests: [Express](https://github.com/hookdeck/webhook-skills/tree/main/skills/dub-webhooks/examples/express/), [Next.js](https://github.com/hookdeck/webhook-skills/tree/main/skills/dub-webhooks/examples/nextjs/), [FastAPI](https://github.com/hookdeck/webhook-skills/tree/main/skills/dub-webhooks/examples/fastapi/).

## Event Handling

The envelope contains id, event, createdAt and data. Dub uses the entire whsec_ string as a UTF-8 HMAC key. Do not strip the prefix or decode the remainder; this scheme does not use the Standard Webhooks signing format.

Acknowledge accepted events promptly and make changes idempotent using the delivery id. Store secrets only on the server.

## Local Development

```bash
npx hookdeck-cli listen 3000 dub --path /webhooks/dub

```

Use port 8000 for FastAPI. The CLI provides a local tunnel and inspection UI; no account is required to start.

## Resources

* [Overview and event routing](https://github.com/hookdeck/webhook-skills/blob/main/skills/dub-webhooks/references/overview.md)
* [Endpoint and secret setup](https://github.com/hookdeck/webhook-skills/blob/main/skills/dub-webhooks/references/setup.md)
* [Verification and troubleshooting](https://github.com/hookdeck/webhook-skills/blob/main/skills/dub-webhooks/references/verification.md)