Receive Developer webhooks

Steps

1. 1
   Step 1Mark as done: step 1

   Open Developer settings

   Under Settings in the left-hand menu, click Developer and scroll to Webhooks.

   Where to find it in Skylane

   1. Settings
   2. Developer
   3. Webhooks
2. 2
   Step 2Mark as done: step 2

   Add the webhook

   Paste your address into Webhook URL, tick the events under Events to send and click Create webhook.

   Skylane

   ProfileNotificationsSecurityDeveloper

   Developer API keysWebhook URLhttps://example.com/skylane-webhookCreate webhook

3. 3
   Step 3Mark as done: step 3

   Copy the signing secret

   Under Copy your signing secret now, click Copy secret and store it in your server's secret settings. It is shown once. Then click I have saved my secret.

4. 4
   Step 4Mark as done: step 4

   Check every signature

   Each message has Skylane-Signature: t=<unix time>,v1=<hex>: an HMAC-SHA256 of the timestamp, a full stop and the raw body, using your secret. Reject anything that does not match or is more than 5 minutes old.

   import crypto from "node:crypto";
   
   // rawBody must be the exact bytes Skylane sent. Do not parse and re-serialise the JSON first.
   export function verifySkylane(rawBody, header, secret, toleranceSeconds = 300) {
     const fields = Object.fromEntries(String(header || "").split(",").map((part) => part.split("=", 2)));
     const timestamp = Number(fields.t);
     if (!timestamp || !fields.v1) return false;
     if (Math.abs(Date.now() / 1000 - timestamp) > toleranceSeconds) return false;
     const expected = crypto.createHmac("sha256", secret).update(`${timestamp}.`).update(rawBody).digest("hex");
     const a = Buffer.from(expected, "hex");
     const b = Buffer.from(fields.v1, "hex");
     return a.length === b.length && crypto.timingSafeEqual(a, b);
   }
   
   // Express example: keep the raw body for this route.
   // app.post("/skylane-webhook", express.raw({ type: "application/json" }), (req, res) => {
   //   if (!verifySkylane(req.body, req.get("Skylane-Signature"), process.env.SKYLANE_WEBHOOK_SECRET)) return res.sendStatus(401);
   //   const event = JSON.parse(req.body);
   //   res.sendStatus(200); // reply first, then do the slow work
   // });

5. 5
   Step 5Mark as done: step 5

   Reply fast, then work

   Reply with any 2xx within 5 seconds. Skylane-Event names the event and Skylane-Delivery is the event id, which stays the same on retries and redeliveries, so store it and ignore repeats.

6. 6
   Step 6Mark as done: step 6

   Send a test

   Click Send test next to the webhook. The result shows straight away and appears in the delivery log.

7. 7
   Step 7Mark as done: step 7

   Use the delivery log

   Click Deliveries to see the last 50 messages, their state and the next retry time. View message shows exactly what was sent, and Redeliver sends it again.