Front Webhooks

When to Use This Skill

• Setting up Front (Frontapp) application webhook handlers
• Debugging Front X-Front-Signature verification failures
• Responding to the Front X-Front-Challenge subscription validation request
• Understanding Front event types (inbound_received, outbound_sent, conversation_moved, assignee_changed, tag_added, new_comment_added) and payloads

Verification (core)

Front application webhooks have no official server SDK, so verify manually. Front signs X-Front-Request-Timestamp + ":" + rawBody with HMAC-SHA256 (key = your app's signing key), base64-encoded, delivered in the X-Front-Signature header. Use the raw request body — never JSON.parse before verifying.

const crypto = require('crypto');