---
name: "svix-webhook-signatures-dispatcher"
description: "Verify incoming webhook HMAC signatures and dispatch outbound webhooks with automated retries."
metadata:
  author: "Svix"
  version: "1.0.0"
  runtime_compatibility:
    - "codex"
    - "claude-code"
    - "cursor"
    - "windsurf"
triggers:
  - "verify svix webhook signature"
  - "prevent webhook replay attacks"
  - "svix webhook dispatcher"
permissions:
  fs_read: true
  fs_write: "workspace"
  shell_exec: false
  net_access: false
---

# Svix Enterprise Webhook Ingestion & Signature Verification

Integrates Svix: verifying webhook signatures (Webhook.verify), timestamp tolerance checks to prevent replay attacks, handling outbound webhook events, exponential retry schedules, and Svix customer portal.

## When to Invoke
Invoke this skill whenever you need to:
- verify svix webhook signature
- prevent webhook replay attacks
- svix webhook dispatcher

## Execution SOP & Rules
1. Retrieve headers: svix-id, svix-timestamp, and svix-signature from incoming request.
2. Initialize verifier: const wh = new Webhook(process.env.WEBHOOK_SECRET);
3. Verify payload: const payload = wh.verify(rawBody, { 'svix-id': id, 'svix-timestamp': ts, 'svix-signature': sig });
4. Catch WebhookVerificationError and return 400 Bad Request on invalid cryptographic signatures.

## Verification Checklist
- Run local linting, syntax validation, and type-checks before reporting completion.
- Ensure all created or modified files adhere to workspace boundaries and avoid uncommitted secrets.
- Verify tests or build commands exit cleanly with return code 0.