Zendesk Webhooks Skill

When to Use This Skill

• Setting up Zendesk webhook handlers
• Debugging Zendesk signature verification failures
• Understanding Zendesk event subscriptions vs. trigger/automation webhooks
• Handling ticket, user, or organization events like zen:event-type:ticket.created

Verification (core)

Zendesk signs every webhook with HMAC-SHA256, base64-encoded. The signed message is the timestamp concatenated directly with the raw request body (no separator): base64(HMAC_SHA256(timestamp + body)). Zendesk does not follow the Standard Webhooks spec and ships no official verification SDK, so verify manually with the language's crypto primitives.

Two headers are sent:

• X-Zendesk-Webhook-Signature — the base64 signature
• X-Zendesk-Webhook-Signature-Timestamp — the timestamp that is prepended to the body

Use the raw body — don't JSON.parse first. Some requests (e.g. GET/DELETE methods on a webhook) have no body, so account for an empty body.

const crypto = require('crypto');

function verifyZendeskWebhook(rawBody, signature, timestamp, secret) {
  const hmac = crypto.createHmac('sha256', secret);
  hmac.update(timestamp);        // timestamp first...
  hmac.update(rawBody);          // ...then the raw body (Buffer), no separator
  const expected = hmac.digest('base64');
  try {
    return crypto.timingSafeEqual(Buffer.from(expected), Buffer.from(signature));
  } catch {
    return false;                // length mismatch = invalid
  }
}

The signing secret comes from GET /api/v2/webhooks/{webhook_id}/signing_secret (or Admin Center → the webhook → Reveal secret). Test webhooks (before creation) always use the static secret dGhpc19zZWNyZXRfaXNfZm9yX3Rlc3Rpbmdfb25seQ==.

For complete handlers with route wiring, event dispatch, and tests, see:

• examples/express/
• examples/nextjs/
• examples/fastapi/

Two Webhook Models

Zendesk webhooks work in one of two mutually exclusive modes:

1. Event subscriptions — the webhook subscribes to zen:event-type:* events. Zendesk sends a CloudEvents-style envelope with a type field you dispatch on.
2. Connected to a trigger or automation — the payload is custom JSON you define in the trigger/automation body (no type field).

A single webhook cannot both subscribe to events and be connected to a trigger. Signature verification is identical for both.

Common Event Types (event subscriptions)

For the full event reference, see Zendesk webhook event types.

Environment Variables

ZENDESK_WEBHOOK_SECRET=your_signing_secret_here   # from GET /api/v2/webhooks/{id}/signing_secret

Local Development

# Start tunnel (no account needed)
npx hookdeck-cli listen 3000 zendesk --path /webhooks/zendesk

Reference Materials

• references/overview.md - Zendesk webhook concepts, event subscriptions vs. triggers
• references/setup.md - Admin Center configuration, getting the signing secret
• references/verification.md - Signature verification details and gotchas