Enode Webhooks Skill

When to Use This Skill

• Setting up Enode webhook handlers
• Debugging Enode signature verification failures
• Understanding Enode event types and payloads
• Handling user:vehicle:updated, user:charger:updated, or user:battery:updated events
• Why is my Enode webhook signature verification (x-enode-signature) failing?

Verification (core)

Enode signs the raw request body with HMAC-SHA1 keyed on the per-webhook secret you generated (min 128 bits) and supplied at webhook creation. The digest is sent in the x-enode-signature header formatted as sha1=<hex> (lowercase hex). Enode does not follow the Standard Webhooks spec. Pass the raw body, and compare timing-safe.

Node:

const crypto = require('crypto');

function verify(rawBody, signatureHeader, secret) {
  const [algo, sig] = (signatureHeader || '').split('=');
  if (algo !== 'sha1' || !sig) return false;
  const expected = crypto.createHmac('sha1', secret).update(rawBody).digest('hex');
  try {
    return crypto.timingSafeEqual(Buffer.from(sig), Buffer.from(expected));
  } catch {
    return false;
  }
}

Python:

import hmac, hashlib

def verify(raw_body: bytes, signature_header: str, secret: str) -> bool:
    algo, _, sig = (signature_header or "").partition("=")
    if algo != "sha1" or not sig:
        return False
    expected = hmac.new(secret.encode(), raw_body, hashlib.sha1).hexdigest()
    return hmac.compare_digest(sig, expected)

For complete handlers with route wiring, event dispatch, and tests, see:

• examples/express/
• examples/nextjs/
• examples/fastapi/

Payload Shape

The webhook body is a JSON array of events — a single delivery can carry multiple events. Iterate the array; each element has an event name, a createdAt timestamp, and a version:

[
  { "event": "user:vehicle:updated", "createdAt": "2020-04-07T17:04:26Z", "version": "..." }
]

Common Event Types

For the full event reference, see Enode Webhook Events and references/overview.md.

Important Headers

Environment Variables

ENODE_WEBHOOK_SECRET=your_generated_secret   # You generate this (min 128 bits) and pass it when creating the webhook

Enode does not return the secret — you generate it (e.g. openssl rand -hex 32) and supply it in the secret field of POST /webhooks.

Local Development

# Start tunnel (no account needed)
npx hookdeck-cli listen 3000 enode --path /webhooks/enode

Reference Materials

• references/overview.md - Enode webhook concepts and events
• references/setup.md - Creating webhooks via the Enode API
• references/verification.md - Signature verification details