AfterShip Webhooks

AfterShip (aftership.com) is the post-purchase platform. Four of its products send webhooks — Tracking (the flagship shipment-tracking product), Shipping (formerly Postmen), Returns, and Warranty. They all use the same HMAC algorithm but send the signature under three different header names.

When to Use This Skill

• How do I receive AfterShip webhooks?
• How do I verify AfterShip webhook signatures?
• What is the aftership-hmac-sha256 header and how do I validate it?
• Why is my AfterShip webhook signature verification failing?
• How do I handle tracking_update, edd_revise, or tracking_pending_time events?
• How do I route on msg.tag (InTransit, Delivered, Exception, …)?
• How do I verify AfterShip Returns (as-signature-hmac-sha256) or Shipping (am-webhook-signature) webhooks?

Verification (core)