Alchemy Webhooks

When to Use This Skill

• How do I receive Alchemy webhooks?
• How do I verify Alchemy webhook signatures (the X-Alchemy-Signature header)?
• How do I handle ADDRESS_ACTIVITY, MINED_TRANSACTION, or NFT_ACTIVITY events?
• Why is my Alchemy webhook signature verification failing?
• How do I set up Alchemy Notify webhooks for onchain activity?

Verification (core)

Alchemy signs every webhook with HMAC-SHA256 over the raw request body, hex-encoded, in the X-Alchemy-Signature header. There is no sha256= prefix and no timestamp — just the hex digest. The key is the per-webhook signing key (copied from the top-right of that webhook's detail page in the Notify dashboard, or fetched via the Notify API), not your app's Auth Token.

The alchemy-sdk npm package manages webhook CRUD but does not verify signatures — implement HMAC yourself. Always compute the HMAC over the raw body; a re-serialized JSON body will not match.