Calendly Webhooks

When to Use This Skill

• How do I receive Calendly webhooks?
• How do I verify Calendly webhook signatures?
• How do I handle invitee.created or invitee.canceled events?
• Why is my Calendly webhook signature verification failing?
• Setting up Calendly webhook handlers and debugging replay protection

Verification (core)

Calendly signs each webhook with the Calendly-Webhook-Signature header, which contains a timestamp and a signature: t=<timestamp>,v1=<signature>. Compute HMAC-SHA256 (hex) over {timestamp}.{raw body} using the subscription's signing key, compare timing-safe, and reject stale timestamps (~3 min) to prevent replay. Calendly has no SDK verification helper — verify manually and always use the raw request body (don't JSON.parse first).