Bitbucket Webhooks

When to Use This Skill

• Setting up Bitbucket Cloud webhook handlers
• Debugging Bitbucket signature verification failures
• Understanding Bitbucket event keys and payloads
• Handling repo:push, pull request, or issue events

Verification (core)

Bitbucket signs the raw request body with HMAC-SHA256 keyed on your webhook secret and sends the digest in the X-Hub-Signature header formatted as sha256=<hex> (the prefix names the algorithm — currently sha256). Pass the raw body, and compare timing-safe. Webhooks configured without a secret are unsigned and send no X-Hub-Signature header.

Node: