Quoter Webhooks

When to Use This Skill

• Setting up Quoter webhook handlers
• Debugging Quoter hash verification failures
• Understanding Quoter object types (Quote, Person, Payment) and create vs update
• Parsing the application/x-www-form-urlencoded hash / timestamp / data payload

⚠️ Security Warning: Weak Verification Scheme

Quoter does not use HMAC-SHA256, and it is not Standard Webhooks. It uses a legacy MD5 shared-secret hash, and the hash key is optional — a Quoter webhook can be configured with no verification at all.

• The signature is a form field named hash, not an HTTP header.
• Always set a hash key in Quoter (Settings → Integrations). Without one, anyone who learns your endpoint URL can forge requests.
• MD5 is cryptographically broken. Treat this as a low-assurance check and pair it with a network-level control (IP allowlist, a shared secret in the URL path, or fronting the endpoint with Hookdeck).

Verification (core)