Twitter / X Webhooks

Twitter/X delivers account activity through the Account Activity API. Your public HTTPS endpoint must do two things:

1. Answer the CRC (Challenge-Response Check) — X sends a GET request with a crc_token query parameter at registration, roughly hourly, and on demand. You must reply within the timeout with a response_token, or the webhook is marked invalid and delivery stops.
2. Verify POST deliveries — every event POST carries an x-twitter-webhooks-signature header you validate before processing.

Both use the same primitive: HMAC-SHA256 keyed with your app's consumer secret (API secret key), base64-encoded, prefixed with sha256=. Use the consumer secret — not the bearer token or user access token.

When to Use This Skill