Linear Webhooks

When to Use This Skill

• Setting up Linear webhook handlers
• Debugging Linear signature verification failures
• Validating the Linear-Signature HMAC-SHA256 header
• Handling Linear Issue, Comment, Project, Cycle, IssueLabel, or IssueSLA events
• Reacting to create, update, and remove actions on Linear entities
• Rejecting stale webhook deliveries via the webhookTimestamp field

Essential Code (USE THIS)

Linear Signature Verification (JavaScript)

Linear signs each webhook with HMAC-SHA256 over the raw request body, hex-encoded, sent in the Linear-Signature header. The official @linear/sdk ships a helper, LinearWebhookClient from @linear/sdk/webhooks, whose verify(rawBody, signature) checks the same HMAC and the body's webhookTimestamp (see references/verification.md). The manual version below does the same work with no dependency and is what the examples use.

const crypto = require('crypto');