faundit-webhooks
Installation
SKILL.md
Faundit Webhooks
When to Use This Skill
- Setting up Faundit webhook handlers
- Debugging Faundit signature verification failures
- Understanding Faundit event types (
item-status,request-status) and payloads - Handling lost-and-found item and request status changes (delivered, finished, expired, etc.)
Verification (core)
Faundit signs each webhook with HMAC-SHA256 (hex) and delivers two headers you care about:
X-Faundit-Signature-Next— current (v1) scheme, signsv1:<timestamp>:<body>(payload integrity). Prefer this.X-Faundit-Timestamp— the timestamp used in the signed string.X-Faundit-Signature— deprecated (v0) scheme, signsv0:<timestamp>only (no body integrity). Avoid.
There is no official Faundit SDK — verify manually. Use the raw request body (before JSON.parse), and build the signed string as v1: + the X-Faundit-Timestamp value + : + raw body.