Agent skill

Reditus Webhooks Skill

Receive and verify Reditus webhooks (affiliate and referral program software). Use when setting up a Reditus webhook endpoint, debugging X-Signature verification, or handling partnership.accepted, referral.created, advocate.created, lead.created and reward.created events.

Install this skill

npx skills add hookdeck/webhook-skills --skill reditus-webhooks

Reditus (getreditus.com) sends a webhook when a partnership is accepted or a referral, advocate, lead or reward is created. Each request is signed: the X-Signature header holds the hex HMAC-SHA256 of the raw request body, keyed with your webhook secret.

When to Use This Skill

How do I receive Reditus webhooks?
How do I verify the Reditus X-Signature header?
Why does my Reditus webhook signature verification fail?
How do I handle reward.created or lead.created events?
Which HTTP method does Reditus use? (Not documented: accept any)

Verification (core)

The header is the bare lowercase hex digest: no prefix, no list, and only the body is signed (no timestamp or id, so there is no replay window to check). The key is the secret's UTF-8 bytes, used as-is.

const crypto = require('crypto');

function verifyReditusSignature(rawBody, signature, secret = process.env.REDITUS_WEBHOOK_SECRET) {
  if (!secret || typeof signature !== 'string') return false;
  if (!/^[0-9a-fA-F]{64}$/.test(signature)) return false;     // validate before decoding

  const expected = crypto.createHmac('sha256', secret).update(rawBody).digest(); // rawBody: Buffer
  const received = Buffer.from(signature.toLowerCase(), 'hex');
  return received.length === expected.length && crypto.timingSafeEqual(received, expected);
}

Sign the raw body bytes exactly as received. Never JSON.parse/JSON.stringify first, and never decode and re-encode to a string.
Hex is compared case-insensitively. Missing or empty header, malformed value or mismatch: 401.
Express: express.raw({ type: '*/*' }). Next.js: await request.arrayBuffer(). FastAPI: await request.body(). Python: hmac.compare_digest on bytes.
The HTTP method is not documented. Accept GET, POST, PUT, PATCH and DELETE on the route and verify every one. A request with no body is verified over zero bytes, then acknowledged with 200.
Hookdeck: Hookdeck's Reditus source verifies the signature (HMAC SHA-256, x-signature, hex). It pre-selects POST without managing the method, so allow any other method Reditus uses on the source.

For complete handlers with tests, see examples/express/, examples/nextjs/, examples/fastapi/.

Event Types

Dispatch on the top-level event_type; url, created_at (a date) and data sit beside it.

`event_type`	Fires when
`partnership.accepted`	An affiliate partnership is accepted
`referral.created`	A referral is created (affiliate program)
`advocate.created`	An advocate is created (referral program)
`lead.created`	A lead is created
`reward.created`	A reward is generated

Treat every field of the parsed body as untrusted: check types before reading into data. Log event types you don't handle and return 200.

Environment Variables

REDITUS_WEBHOOK_SECRET=your_reditus_webhook_secret

Reditus's docs don't say where the webhook secret is shown or how it is set.

Delivery

Reditus's docs say nothing about retries, timeouts or the expected response. Return 2xx quickly and make handling idempotent (see webhook-handler-patterns).

Local Development

npx hookdeck-cli listen 3000 reditus --path /webhooks/reditus

No account required. Use the printed URL as the endpoint in Reditus.

Resources

references/overview.md - Events and payload shape
references/setup.md - Endpoint, secret and method notes
references/verification.md - Signature details, gotchas, debugging
examples/ - Runnable Express, Next.js and FastAPI handlers with tests