Slack Webhooks

When to Use This Skill

• Setting up a Slack Events API webhook handler (Request URL)
• Debugging X-Slack-Signature verification failures
• Handling the initial url_verification challenge from Slack
• Processing events like app_mention, message, reaction_added, team_join, or app_home_opened
• Returning a 2xx response within 3 seconds to avoid Slack retries

Essential Code (USE THIS)

Slack signs every Events API request with HMAC-SHA256. The signed content is the literal string v0:{timestamp}:{raw_body}, and the result is sent as X-Slack-Signature: v0=<hex>. Use the raw request body — parsing JSON before verifying will change byte ordering and break the signature.

Slack Signature Verification (JavaScript)