Oura Webhooks

When to Use This Skill

• How do I receive Oura webhooks?
• How do I complete the Oura subscription verification handshake (GET challenge)?
• How do I verify the x-oura-signature header?
• Why is my Oura webhook signature verification failing?
• How do I handle Oura sleep, daily_readiness, or workout events?

How Oura Webhooks Work

Oura webhooks have two distinct request types on the same callback URL:

1. Subscription handshake (GET): When you create a subscription, Oura sends a GET to your callback_url with query params verification_token and challenge. Check the token matches yours, then respond 200 with JSON {"challenge": "<value>"}.
2. Event delivery (POST): Each event is a POST carrying headers x-oura-signature and x-oura-timestamp. Verify the HMAC, then process.