Statsig Webhooks

When to Use This Skill

• Setting up a Statsig Event Webhook (the "Generic Webhook" integration)
• Debugging X-Statsig-Signature verification failures
• Processing exposure events or config-change notifications (feature gate, experiment, or dynamic config created / updated events)
• Handling Statsig's JSON batch payloads (arrays) and the config-change { "data": [...] } envelope

Essential Code (USE THIS)

Statsig signs every webhook request with HMAC-SHA256 using a Slack/Stripe-style scheme (this is not the Standard Webhooks spec). The signed content is the literal string v0:{timestamp}:{raw_body}, and the result is sent as X-Statsig-Signature: v0=<hex>. Use the raw request body — parsing JSON before verifying will change byte ordering and break the signature.