Discord Webhooks

When to Use This Skill

• Setting up Discord webhook event handlers (outgoing webhooks)
• Verifying Discord Ed25519 signatures with X-Signature-Ed25519 and X-Signature-Timestamp
• Handling the PING (type 0) endpoint validation request
• Handling events like APPLICATION_AUTHORIZED, APPLICATION_DEAUTHORIZED, ENTITLEMENT_CREATE, LOBBY_MESSAGE_CREATE, GAME_DIRECT_MESSAGE_CREATE, QUEST_USER_ENROLLMENT
• Debugging "invalid request signature" errors when registering your webhook endpoint

Note: This skill covers outgoing webhooks (Discord → your server) — the same Ed25519 signing scheme is shared with Interactions endpoints. Incoming webhooks (your server → Discord channel via webhook URL) are not signed and not covered here.

Essential Code (USE THIS)

Discord uses Ed25519 asymmetric signatures (not HMAC). The signed content is the raw concatenation X-Signature-Timestamp + raw_body. Verification uses your application's public key (hex-encoded), available in the Discord Developer Portal.

Express Webhook Handler (Node.js)

Use the official-style discord-interactions helper (built on tweetnacl).