Agent skill

Pipedrive Webhooks Skill

Receive and authenticate Pipedrive webhooks. Use when setting up Pipedrive webhook handlers, debugging HTTP Basic Auth verification, or handling CRM events like create.deal, change.person, or delete.activity.

Install this skill

npx skills add hookdeck/webhook-skills --skill pipedrive-webhooks

When to Use This Skill

  • How do I receive Pipedrive webhooks?
  • How do I authenticate Pipedrive webhook deliveries?
  • How do I handle create.deal, change.person, or delete.activity events?
  • Why is my Pipedrive webhook returning 401 / getting banned?
  • How do I create a Pipedrive webhook (v2) via the API?

Verification (core)

Pipedrive does NOT sign webhooks. There is no HMAC, no signature header, and it is not Standard Webhooks compliant. Security is HTTP Basic Auth: you set http_auth_user / http_auth_password when creating the webhook, and Pipedrive sends them in the standard Authorization: Basic <base64(user:pass)> header on every delivery. Your endpoint must be HTTPS (self-signed certs are not supported). Verify the credentials with a timing-safe comparison:

const crypto = require('crypto');

function safeEqual(a, b) {
  const ab = Buffer.from(a, 'utf8');
  const bb = Buffer.from(b, 'utf8');
  // Length check first: timingSafeEqual throws on unequal-length buffers
  return ab.length === bb.length && crypto.timingSafeEqual(ab, bb);
}

function verifyBasicAuth(authHeader, user, pass) {
  if (!authHeader || !authHeader.startsWith('Basic ')) return false;
  const decoded = Buffer.from(authHeader.slice(6), 'base64').toString('utf8');
  const sep = decoded.indexOf(':');                 // password may contain ':'
  if (sep === -1) return false;
  return safeEqual(decoded.slice(0, sep), user) && safeEqual(decoded.slice(sep + 1), pass);
}

For complete handlers with route wiring, event dispatch, and tests, see:

Event Format

Pipedrive v2 event types are action.entity (e.g. create.deal). The payload does not contain a combined string — build it from meta.action and meta.entity:

const event = `${body.meta.action}.${body.meta.entity}`; // e.g. "change.person"

Actions: create, change, delete, * (wildcard, subscribes to all). Entities: activity, deal, lead, note, organization, person, pipeline, product, stage, user (and more — see overview).

Common Event Types

EventTriggered When
create.dealA deal is created
change.dealA deal is updated (stage, value, owner, …)
delete.dealA deal is deleted
change.personA contact person is updated
create.activityAn activity is created

For the full entity/action list, see references/overview.md.

Payload Structure

{
  "meta": { "action": "change", "entity": "deal", "entity_id": "123", "version": "2.0" },
  "data": { "id": 123, "title": "New deal", "value": 500 },
  "previous": { "value": 300 }
}
  • data — current state of the object (null on delete).
  • previous — only the changed fields on change; last state on delete; null on create.

Environment Variables

PIPEDRIVE_WEBHOOK_USER=my-webhook-user        # http_auth_user you set on the webhook
PIPEDRIVE_WEBHOOK_PASSWORD=a-long-random-secret  # http_auth_password you set on the webhook

# Only needed to register a webhook via the API (see references/setup.md):
PIPEDRIVE_API_TOKEN=xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
PIPEDRIVE_SUBSCRIPTION_URL=https://your-app.com/webhooks/pipedrive

Local Development

# Start tunnel (no account needed)
npx hookdeck-cli listen 3000 pipedrive --path /webhooks/pipedrive

Reference Materials