Zendesk Webhooks

When to Use This Skill

• Setting up Zendesk webhook handlers
• Debugging Zendesk signature verification failures
• Understanding Zendesk event subscriptions vs. trigger/automation webhooks
• Handling ticket, user, or organization events like zen:event-type:ticket.created

Verification (core)

Zendesk signs every webhook with HMAC-SHA256, base64-encoded. The signed message is the timestamp concatenated directly with the raw request body (no separator): base64(HMAC_SHA256(timestamp + body)). Zendesk does not follow the Standard Webhooks spec and ships no official verification SDK, so verify manually with the language's crypto primitives.

Two headers are sent: