Courier Webhooks

When to Use This Skill

• How do I receive Courier outbound webhooks?
• How do I verify the Courier courier-signature header?
• How do I handle message:updated status changes or notification:submitted events?
• Why is my Courier webhook signature verification failing?

Verification (core)

Courier signs every outbound webhook with HMAC-SHA256. The courier-signature header carries a timestamp and hex signature: t=<timestamp>,signature=<hex_digest>. The signed content is `${timestamp}.${rawBody}` — the timestamp, a literal dot, then the raw request body (do not JSON.parse before verifying). Courier has no webhook-verification SDK, so verify manually and compare in constant time.