A comprehensive toolkit for verifying webhook signatures programmatically and managing real-time event alerting.
Install & Download
1. ClawHub CLI
The fastest way to install a skill directly from the registry.
npx clawhub@latest install hookflo-tern
2. Manual Installation
Copy the skill folder to one of these locations
~/.openclaw/skills/ <project>/skills/ Priority: Workspace > Local > Bundled
3. Prompt Installation
Copy this prompt to OpenClaw to install it automatically.
Help me install hookflo-tern using Clawhub. If Clawhub is not installed, install it first (npm i -g clawhub).
Prefer to download?
Get the raw skill files in a ZIP archive.
What is Hookflo + Tern Webhook Verification & Alerting?
Hookflo and Tern form a powerful duo for developers building event-driven systems. Tern is a lightweight, zero-dependency TypeScript library designed to verify incoming webhook signatures across various platforms like Stripe, GitHub, and Clerk. It handles complex HMAC calculations and protects against replay attacks by validating timestamps and signatures.
Hookflo complements this by providing a hosted dashboard for logging events and sending instant notifications to Slack or email. Together, they ensure your webhooks are both secure and observable. These Openclaw Skills simplify the often tedious process of setting up robust HTTP callback handlers in modern web applications.
Hookflo + Tern Webhook Verification & Alerting Use Cases
- Verifying Stripe payment events to update subscription status in your database securely.
- Receiving GitHub repository events to trigger automated CI/CD pipelines or documentation updates.
- Setting up real-time Slack alerts for Clerk user authentication events without writing custom notification logic.
- Implementing secure webhook endpoints in serverless environments like Next.js Route Handlers or Cloudflare Workers.
- Debugging failing webhooks using centralized event logs and delivery history dashboards.
How Hookflo + Tern Webhook Verification & Alerting Works
- The application receives an incoming POST request from a third-party service like Stripe, Shopify, or GitHub.
- Tern extracts the signature from the headers and the raw request body to ensure data integrity.
- The library performs a platform-specific HMAC verification (e.g., HMAC-SHA256) using a pre-configured signing secret.
- If the verification is successful, the payload is parsed and passed to your local application logic.
- Optionally, the event can be forwarded to the Hookflo dashboard to trigger multi-channel alerting and persistent logging.
Hookflo + Tern Webhook Verification & Alerting Setup
To integrate these Openclaw Skills, follow these steps:
Install the Tern library:
npm install @hookflo/tern
Configure your environment variables based on the platforms you use:
export STRIPE_WEBHOOK_SECRET=whsec_...
export GITHUB_WEBHOOK_SECRET=your_secret
export CLERK_WEBHOOK_SECRET=whsec_...
Ensure your web server uses raw body parsing for webhook routes. In Express, use:
app.post('/webhook', express.raw({ type: 'application/json' }), handler);
Hookflo + Tern Webhook Verification & Alerting Data Schema & Taxonomy
The skill utilizes a standardized WebhookVerificationResult object to communicate the status of incoming events. Data organization includes:
| Field | Description |
|---|---|
isValid |
Boolean indicating if the signature matched and timestamp is within tolerance. |
payload |
The parsed JSON body of the webhook for immediate use. |
metadata |
Contextual data including platform-specific IDs and timestamps. |
error |
Descriptive string explaining why a verification might have failed (e.g., signature mismatch). |
Custom configurations allow for mapping non-standard headers, prefixes (like sha256=), and encoding types (base64 or hex).
Hookflo + Tern Webhook Verification & Alerting Advanced Features
- Platform Manager for inspecting built-in configurations and running validation tests.
- Support for token-based verification methods used by platforms like Supabase and GitLab.
- Replay attack protection with customizable tolerance windows (defaulting to 300 seconds).
- Extensible SignatureConfig for integrating any custom SaaS provider not natively listed.
- Proxy pattern support to enable both programmatic processing and no-code monitoring simultaneously.
SKILL.md
Loading
Related Openclaw Skills
MyAgentInbox
A specialized MCP-compatible service that provides disposable email inboxes for AI agents to receive messages and process attachments without persistent accounts.
World News Skill (newsmcp)
A real-time news aggregation skill that provides AI-summarized and clustered world events without requiring an API key.
World News Skill (newsmcp)
An AI-driven news aggregation skill that provides deduplicated, summarized, and categorized world events without requiring an API key.
newsmcp: AI-Powered World News
A zero-auth news aggregation skill that provides AI-summarized and clustered global event data for automated briefings.
OpenAPI Deep Audit & Test Architect
A high-precision AI architect that transforms raw OpenAPI specifications into comprehensive security audits and production-ready test strategies.
Cinematic Script Writer
A professional-grade scriptwriting and cinematography tool designed to generate AI-ready video scripts with deep character and environmental consistency.
METADATA
Featured*
