Attentive Webhooks

When to Use This Skill

• How do I receive Attentive webhooks?
• How do I verify Attentive webhook signatures?
• Why is my x-attentive-hmac-sha256 signature verification failing?
• How do I handle sms.subscribed, sms.unsubscribed, or email.opened events?
• Understanding Attentive event types and payloads

Verification (core)

Attentive signs the raw request body with HMAC-SHA256 keyed on your per-webhook signing key (called the "client secret" in the dashboard) and sends the digest, hex-encoded, in the x-attentive-hmac-sha256 header. There is no timestamp in the signature (Attentive does not use the Standard Webhooks scheme), so compute the HMAC over the exact raw body and compare timing-safe. There is no official server-side SDK, so verify manually.