Xero Webhooks

When to Use This Skill

• How do I receive Xero webhooks?
• How do I verify the x-xero-signature header?
• Why is my Xero webhook stuck as "inactive" / failing Intent to Receive (ITR)?
• How do I handle CONTACT, INVOICE, CREDITNOTE, or SUBSCRIPTION events?
• How do I fetch the changed record from a Xero webhook payload?

Verification (core)

Xero signs the raw request body with HMAC-SHA256 keyed on the app's webhook signing key, base64-encodes the digest, and sends it in the x-xero-signature header. Capture the raw body before JSON parsing (parsing re-serializes the bytes and breaks the HMAC). Compare timing-safe. The official SDKs (xero-node, xero-python) do not ship a webhook-signature helper — verify manually.

Node:

const crypto = require('crypto');