What problem does it solve? Authenticating inbound webhook requests is easy to get wrong: signatures must be compared in constant time, timestamps bounded, replays rejected, and secrets rotated without downtime. This Skill documents how to use the @sdxc/webhooks package to verify inbound deliveries and sign outbound ones, with every failure returned as a typed value instead of a thrown exception. ## Core Features & Use Cases - Inbound Verification: verify() reads the three Standard Webhooks headers, bounds the timestamp, compares the HMAC-SHA256 signature in constant time, optionally checks a KV-backed replay store, and parses the payload only after authentication succeeds. - Outbound Signing: sign() produces the signature headers and the exact body text the signature covers, reusing one delivery id across retries. - Secret Rotation & Replay Protection: options.secrets accepts multiple secrets for zero-downtime rotation, and KVReplayStore rejects duplicate delivery ids through a Workers KV binding. - Use Case: An endpoint receives deliveries from a provider using Standard Webhooks; verify the request first, return 401 on authentication failures, answer 200 on DuplicateDeliveryError to stop retries, and branch on typed errors instead of catching exceptions. ## Quick Start Ask the agent to verify an inbound Standard Webhooks request with @sdxc/webhooks using the WEBHOOK_SECRET environment variable and return 401 on any verification failure.
