Mailchimp Webhooks

When to Use This Skill

• Setting up Mailchimp webhook handlers
• How do I respond to Mailchimp's webhook URL validation (the GET request)?
• How do I secure Mailchimp webhooks (they are not HMAC-signed)?
• Handling audience events: subscribe, unsubscribe, profile, upemail, cleaned, campaign
• Parsing Mailchimp's application/x-www-form-urlencoded payloads

Verification (core)

Mailchimp does NOT sign its webhooks — there is no HMAC and no signature header. You secure the endpoint two ways, both described in Mailchimp's sync audience data with webhooks guide:

1. URL validation (GET): When you save a webhook, Mailchimp sends a GET to the URL to confirm it is reachable. Respond 200 — do not require the secret on GET.
2. Shared secret (POST): Put an unguessable secret in the webhook URL's query string (e.g. https://your.app/webhooks/mailchimp?secret=…) and compare it on every POST with a timing-safe comparison. Always serve the endpoint over HTTPS.

Payloads are application/x-www-form-urlencoded with a top-level type field and data[...] fields.