Ashby Webhooks

When to Use This Skill

• How do I receive Ashby webhooks?
• How do I verify the Ashby-Signature header?
• How do I handle applicationSubmit, candidateHire, or interviewScheduleCreate events?
• Why is my Ashby webhook signature verification failing?

Verification (core)

Ashby signs the raw request body with HMAC-SHA256 keyed on your per-webhook secret token and sends the digest in the Ashby-Signature header formatted as sha256=<hex>. There is no official SDK, so verify manually: compute the HMAC over the raw body (before JSON parsing) and compare the hex digest timing-safe.

The event name is in the body, not a header — every payload is { "action": "<eventName>", "data": {...} }.