Intercom Webhooks

When to Use This Skill

• Setting up Intercom webhook handlers (Developer Hub topic subscriptions)
• Debugging X-Hub-Signature (HMAC-SHA1) verification failures
• Handling conversation, contact, and ticket events
• Responding to the ping handshake when registering a webhook

Essential Code (USE THIS)

Intercom signs every webhook with HMAC-SHA1 over the raw JSON body using your app's client_secret (from the Developer Hub → Basic Info page). The signature is sent in the X-Hub-Signature header as sha1=<hex_digest> (40 hex chars).

Intercom Signature Verification (JavaScript)

const crypto = require('crypto');