Hugging Face Webhooks

When to Use This Skill

• Setting up Hugging Face webhook handlers
• Debugging X-Webhook-Secret verification failures
• Handling repo events on models, datasets, and Spaces
• Reacting to new commits, tags, or branches via updatedRefs
• Building discussion or Pull Request bots on the Hub
• Listening for comments on discussions
• Auto-retraining models when a dataset is updated

Essential Code (USE THIS)

Hugging Face does not use HMAC signatures. Instead, the secret you configure in the webhook settings is sent verbatim in the X-Webhook-Secret header (or as a ?secret= query parameter). Verify with a timing-safe string comparison.

Hugging Face Secret Verification (JavaScript)