Agent skill

Stigg Webhooks Skill

Receive and authenticate Stigg webhooks. Use when setting up Stigg webhook handlers, checking the Stigg-Webhooks-Secret header (Stigg has no payload signature yet), or handling pricing and entitlement events like customer.created, subscription.created, subscription.canceled, and entitlements.updated.

Install this skill

npx skills add hookdeck/webhook-skills --skill stigg-webhooks

Stigg, a pricing and entitlements platform, POSTs JSON to your endpoint when customers, subscriptions, plans, entitlements, or credits change.

When to Use This Skill

How do I receive Stigg webhooks?
How do I verify Stigg webhooks? Is there a Stigg webhook signature?
How do I check the Stigg-Webhooks-Secret header?
How do I handle subscription.created, customer.created, or entitlements.updated events?
Why is my Stigg webhook handler returning 401?

Verification (core)

Stigg does not sign payloads yet (HMAC is on its roadmap). Each event carries the webhook secret from the webhook details page in the Stigg-Webhooks-Secret header. Check that it matches your STIGG_WEBHOOK_SECRET, in constant time:

const crypto = require('crypto');

function verifyStiggSecret(header, secret) {
  if (!header || !secret) return false;
  // Hash both sides so timingSafeEqual always gets equal-length buffers
  const a = crypto.createHash('sha256').update(header).digest();
  const b = crypto.createHash('sha256').update(secret).digest();
  return crypto.timingSafeEqual(a, b);
}

// verifyStiggSecret(req.headers['stigg-webhooks-secret'], process.env.STIGG_WEBHOOK_SECRET)

There's no signed body, so parsing JSON is safe. The examples still read the raw body (express.raw({ type: '*/*' })) so any content type is accepted, then parse it. Fail closed (500) if the secret isn't configured.

For complete handlers with tests, see examples/express/, examples/nextjs/, examples/fastapi/.

Common Event Types

The event name is in the payload's type field. Use messageId to de-duplicate.

Event	Triggered when
`customer.created` / `customer.updated` / `customer.deleted`	Customer lifecycle
`customer.payment_failed`	A customer payment fails
`subscription.created` / `subscription.updated`	Subscription is created or changes
`subscription.canceled` / `subscription.expired`	Subscription ends
`subscription.trial_started` / `subscription.trial_converted` / `subscription.trial_expired`	Trial lifecycle
`subscription.trial.ends_soon`	A trial is about to end
`entitlements.updated`	A customer's effective entitlements change
`entitlement.usage_exceeded`	Usage passes an entitlement limit

Stigg also sends catalog (plan.*, feature.*, addon.*), credit, and promotional entitlement events. See references/overview.md.

Environment Variables

STIGG_WEBHOOK_SECRET=your_webhook_secret   # from the webhook details page in Stigg

Local Development

For local webhook testing, run the Hookdeck CLI via npx (no install required):

npx hookdeck-cli listen 3000 stigg --path /webhooks/stigg

No account required. The CLI provides a public URL that tunnels to your local server, plus a web UI for inspecting requests.

Reference Materials

references/overview.md - Stigg webhook concepts, events, payload envelope, retries
references/setup.md - Create a webhook and find its secret
references/verification.md - Secret header check and gotchas
examples/ - Express, Next.js, and FastAPI handlers with tests