sent-webhook-engineer

Sent Webhook Engineer is an end-to-end reference for building and debugging Sent v3 webhook receivers. It starts from the fact that webhooks are the only way an application learns what happened after POST /v3/messages returns 202, since the 202 proves acceptance and never delivery. The skill's central deliverable is a correct, security-hardened receiver: one that verifies HMAC signatures, rejects replays, deduplicates events, acknowledges quickly, and treats the delivery log as the source of truth when events go missing.

It specifies the exact signature-verification procedure (capture raw body bytes before parsing, strip the whsec_ prefix and base64-decode the key, build the signed content from webhook id, timestamp, and raw body, compute HMAC-SHA256, compare in constant time, and reject when the timestamp is outside a 300-second tolerance), noting the scheme is Svix-compatible and always hand-written because no Sent SDK ships a helper. Reference files provide framework-by-framework raw-body accessor recipes (Next.js, Express, NestJS, FastAPI, Django, Flask, Go/Gin/Echo, Spring Boot, Laravel, Rails, ASP.NET Core), a failure-triage order, retry and auto-disable behavior (ten consecutive failures disable an endpoint), secret rotation, and delivery-log interpretation. A verify_signature.py script serves as the reference oracle.

It targets backend engineers integrating Sent who need to verify x-webhook-signature, fix 401 or signature-mismatch failures, recover a disabled endpoint, choose event types and filters, or rotate a signing secret. The content is defensive security engineering; documented environment variables (SENT_DM_API_KEY, SENT_DM_WEBHOOK_SECRET) are standard secret-handling guidance with no exfiltration.