Jira Webhooks

When to Use This Skill

• How do I receive Jira webhooks?
• How do I verify Jira webhook signatures?
• How do I handle jira:issue_created or jira:issue_updated events?
• Why is my Jira webhook signature verification failing?
• Understanding Jira event types and payloads

Verification (core)

Jira Cloud signs the raw request body with HMAC-SHA256 keyed on the secret you set when registering a dynamic/OAuth 2.0 webhook, and sends the digest in the X-Hub-Signature header using the WebSub method=signature format — i.e. sha256=<hex>. Verify the raw body before parsing JSON and compare timing-safe.