Coinbase Commerce Webhooks

When to Use This Skill

• Setting up Coinbase Commerce webhook handlers for cryptocurrency payments
• Debugging X-CC-Webhook-Signature verification failures
• Understanding Coinbase Commerce charge event types and payloads
• Handling charge:confirmed, charge:failed, or charge:pending events

Verification (core)

Coinbase Commerce signs the raw request body with HMAC-SHA256 keyed on your webhook shared secret and sends the hex digest in the X-CC-Webhook-Signature header. Verify against the raw body (never the parsed JSON) and compare timing-safe. The event object is nested under the event key in the body.

Node — use the official coinbase-commerce-node SDK: