Jira Webhooks

When to Use This Skill

• How do I receive Jira webhooks?
• How do I verify Jira webhook signatures?
• How do I handle jira:issue_created or jira:issue_updated events?
• Why is my Jira webhook signature verification failing?
• Understanding Jira event types and payloads

Verification (core)

For admin webhooks (created on the Jira admin WebHooks page or via POST /rest/webhooks/1.0/webhook) saved with a secret, Jira Cloud signs the raw request body with HMAC-SHA256 keyed on that secret. It sends the digest in the X-Hub-Signature header (not X-Hub-Signature-256) using the WebSub method=signature format, i.e. sha256=<hex>. Verify the raw body before parsing JSON and compare timing-safe.