Trello Webhooks

When to Use This Skill

• How do I receive Trello webhooks?
• How do I verify Trello webhook signatures?
• How do I handle createCard, updateCard, or commentCard events?
• Why is my Trello x-trello-webhook signature verification failing?
• How do I create a Trello webhook and pass the HEAD validation check?

Verification (core)

Trello signs each delivery with HMAC-SHA1 keyed on your OAuth 1.0 application secret (the "OAuth1.0 secret" on your Power-Up's API Key tab). The signed content is the raw request body concatenated with the exact callback URL used when the webhook was created, and the digest is sent base64-encoded in the x-trello-webhook header. Use the raw body (never re-serialized JSON) and compare timing-safe.