# Hugging Face Webhooks

## When to Use This Skill

* Setting up Hugging Face webhook handlers
* Debugging `X-Webhook-Secret` verification failures
* Handling repo events on models, datasets, and Spaces
* Reacting to new commits, tags, or branches via `updatedRefs`
* Building discussion or Pull Request bots on the Hub
* Listening for comments on discussions
* Auto-retraining models when a dataset is updated

## Essential Code (USE THIS)

Hugging Face does not use HMAC signatures. Instead, the secret you configure in the webhook settings is sent verbatim in the `X-Webhook-Secret` header (or as a `?secret=` query parameter). Verify with a timing-safe string comparison.

### Hugging Face Secret Verification (JavaScript)

```javascript
const crypto = require('crypto');

function verifyHuggingFaceWebhook(secretHeader, secret) {
  if (!secretHeader || !secret) return false;

  // Hugging Face sends the secret verbatim — compare directly,
  // but use timing-safe comparison to prevent timing attacks.
  try {
    return crypto.timingSafeEqual(
      Buffer.from(secretHeader),
      Buffer.from(secret)
    );
  } catch {
    // Buffers must be same length for timingSafeEqual
    return false;
  }
}

```

### Express Webhook Handler

```javascript
const express = require('express');
const crypto = require('crypto');
const app = express();

// CRITICAL: Use express.json() — Hugging Face sends JSON payloads
app.post('/webhooks/huggingface',
  express.json(),
  (req, res) => {
    // Header takes precedence; fall back to ?secret= query parameter
    const secretHeader = req.headers['x-webhook-secret'] || req.query.secret;

    if (!verifyHuggingFaceWebhook(secretHeader, process.env.HUGGINGFACE_WEBHOOK_SECRET)) {
      console.error('Hugging Face webhook verification failed');
      return res.status(401).send('Unauthorized');
    }

    const { event, repo, discussion, comment, updatedRefs, updatedConfig, webhook } = req.body;

    // event.scope + event.action identifies the event type
    const key = `${event.scope}.${event.action}`;
    console.log(`Received ${key} on ${repo.type} ${repo.name}`);

    switch (event.scope) {
      case 'repo':
        // create | update | delete | move
        console.log(`Repo ${event.action}: ${repo.name}`);
        break;
      case 'repo.content':
        // action is always "update"
        console.log(`Repo content updated on ${repo.name}, refs:`, updatedRefs);
        break;
      case 'repo.config':
        // action is always "update"
        console.log(`Repo config updated:`, updatedConfig);
        break;
      case 'discussion':
        // create | update | delete
        console.log(`Discussion ${event.action} #${discussion?.num}: ${discussion?.title}`);
        break;
      case 'discussion.comment':
        // create | update
        console.log(`Comment ${event.action} by ${comment?.author?.id}`);
        break;
      default:
        // Forward-compatibility: treat narrowed scopes (e.g. repo.config.dois)
        // as an "update" on the broader scope.
        console.log(`Unknown scope: ${event.scope} (${event.action})`);
    }

    res.json({ received: true });
  }
);

```

### Python Secret Verification (FastAPI)

```python
import secrets

def verify_huggingface_webhook(secret_header: str | None, secret: str | None) -> bool:
    if not secret_header or not secret:
        return False

    # Hugging Face sends the secret verbatim — timing-safe string comparison.
    return secrets.compare_digest(secret_header, secret)

```

> For complete working examples with tests, see:
> 
> * [examples/express/](https://github.com/hookdeck/webhook-skills/tree/main/skills/huggingface-webhooks/examples/express/) - Full Express implementation
> * [examples/nextjs/](https://github.com/hookdeck/webhook-skills/tree/main/skills/huggingface-webhooks/examples/nextjs/) - Next.js App Router implementation
> * [examples/fastapi/](https://github.com/hookdeck/webhook-skills/tree/main/skills/huggingface-webhooks/examples/fastapi/) - Python FastAPI implementation

## Common Event Types

Hugging Face webhook events are identified by `event.scope` + `event.action`.

| `event.scope` | `event.action` values | Description |
| --- | --- | --- |
| `repo` | `create`, `update`, `delete`, `move` | Global events on a repo (model, dataset, Space) |
| `repo.content` | `update` | New commits, branches, or tags. `updatedRefs` is included |
| `repo.config` | `update` | Settings, secrets, DOI, privacy changes. `updatedConfig` is included |
| `discussion` | `create`, `update`, `delete` | Discussion or Pull Request opened, retitled, merged, or closed |
| `discussion.comment` | `create`, `update` | Comment created or edited (or hidden — `content` is undefined when `hidden: true`) |

> A discussion is also a Pull Request when `discussion.isPullRequest` is `true`.

Forward-compatibility: New narrowed scopes may be added (e.g. `repo.config.dois`). Treat unknown narrowed scopes as an `update` on the broader scope.

## Payload Shape

```json
{
  "event": { "action": "create", "scope": "discussion" },
  "repo": {
    "type": "model",
    "name": "openai-community/gpt2",
    "id": "621ffdc036468d709f17434d",
    "private": false,
    "url": { "web": "...", "api": "..." },
    "headSha": "c379e8...",
    "owner": { "id": "628b75..." }
  },
  "discussion": { "id": "...", "title": "...", "num": 19, "isPullRequest": true, "status": "open", "author": { "id": "..." }, "changes": { "base": "refs/heads/main" } },
  "comment":    { "id": "...", "author": { "id": "..." }, "content": "...", "hidden": false },
  "updatedRefs":   [{ "ref": "refs/heads/main", "oldSha": "...", "newSha": "..." }],
  "updatedConfig": { "private": false },
  "webhook": { "id": "...", "version": 3 }
}

```

* `repo.headSha` is only sent on `repo.*` scopes (not on community events).
* `updatedRefs[].oldSha` is `null` for newly created refs; `newSha` is `null` for deleted refs.
* `repo.type` is `model`, `dataset`, or `space`.

## Important Headers

| Header | Description |
| --- | --- |
| `X-Webhook-Secret` | Secret token configured in the webhook settings, sent verbatim. ASCII only. |

The secret may alternatively be passed as a `?secret=XXX` query parameter on the handler URL.

## Environment Variables

```bash
HUGGINGFACE_WEBHOOK_SECRET=your_secret_value   # The secret you set in HF webhook settings

```

## Rate Limiting

Each Hugging Face webhook is limited to 1,000 triggers per 24 hours. Activity (delivery history and replay) is visible in the webhook settings.

## Local Development

```bash
npx hookdeck-cli listen 3000 huggingface --path /webhooks/huggingface

```

## Reference Materials

* [references/overview.md](https://github.com/hookdeck/webhook-skills/blob/main/skills/huggingface-webhooks/references/overview.md) - Hugging Face webhook concepts and event types
* [references/setup.md](https://github.com/hookdeck/webhook-skills/blob/main/skills/huggingface-webhooks/references/setup.md) - Configure webhooks in Hugging Face settings
* [references/verification.md](https://github.com/hookdeck/webhook-skills/blob/main/skills/huggingface-webhooks/references/verification.md) - Secret verification details and gotchas