Skip to content

fix(skills): match Hookdeck value_prefix and API key field names #269

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
garethx merged 3 commits into from
Nov 6, 2026
Merged

fix(skills): match Hookdeck value_prefix and API key field names #269

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
dfbcfc1
fix(skills): match Hookdeck value_prefix and API key field names
claude Nov 6, 2026
801d3e6
fix(providers): drop stale Hookdeck whole-value notes for prefix types
claude Nov 6, 2026
f97051e
fix(providers): use API Key Header / API Key in generator notes
claude Nov 6, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 1 addition & 2 deletions providers/100ms.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,8 +12,7 @@ notes: >
header name from HUNDRED_MS_WEBHOOK_HEADER (default 'Authorization') and the expected value from
HUNDRED_MS_WEBHOOK_SECRET (the exact, whole header value, including any 'Bearer ' prefix the user
typed). Look the header up case-insensitively and compare the WHOLE value; do not strip or parse a
'Bearer ' prefix. This is what Hookdeck's 100ms source does (API key verification: Header Name +
exact whole Header Value). Missing header or mismatch: 401. Compare in constant time: Node checks
'Bearer ' prefix. This is what Hookdeck's 100ms source does (API key verification: API Key Header + exact whole API Key value). Missing header or mismatch: 401. Compare in constant time: Node checks
lengths, then crypto.timingSafeEqual on equal-length Buffers (or on SHA-256 digests of both
sides); Python uses hmac.compare_digest on bytes (encode both sides; never pass str, which raises
on non-ASCII). SKILL.md and verification.md must say plainly that a static shared credential
Expand Down
2 changes: 1 addition & 1 deletion providers/arcadia.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,7 +14,7 @@ notes: >
'X-Arcadia-Token') and the expected value from ARCADIA_WEBHOOK_SECRET (the exact, whole header
value, including any 'Bearer ' prefix the user typed). Look the header up case-insensitively and
compare the WHOLE value; do not strip or parse a 'Bearer ' prefix. This is what Hookdeck's Arcadia
source does (API key verification: Header Name + exact whole Header Value). Missing header or
source does (API key verification: API Key Header + exact whole API Key value). Missing header or
mismatch: 401. Compare in constant time: Node checks lengths, then crypto.timingSafeEqual on
equal-length Buffers (or on SHA-256 digests of both sides); Python uses hmac.compare_digest on
bytes (encode both sides; never pass str, which raises on non-ASCII). SKILL.md and verification.md
Expand Down
3 changes: 1 addition & 2 deletions providers/argo-cd.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,8 +15,7 @@ notes: >
from ARGO_CD_WEBHOOK_HEADER (default 'Authorization') and the expected value from
ARGO_CD_WEBHOOK_SECRET (the exact, whole header value, including any 'Bearer ' prefix the user
typed). Look the header up case-insensitively and compare the WHOLE value; do not strip or parse a
'Bearer ' prefix. This is what Hookdeck's Argo CD source does (API key verification: Header Name +
exact whole Header Value). Missing header or mismatch: 401. Compare in constant time: Node checks
'Bearer ' prefix. This is what Hookdeck's Argo CD source does (API key verification: API Key Header + exact whole API Key value). Missing header or mismatch: 401. Compare in constant time: Node checks
lengths, then crypto.timingSafeEqual on equal-length Buffers (or on SHA-256 digests of both
sides); Python uses hmac.compare_digest on bytes (encode both sides; never pass str, which raises
on non-ASCII). SKILL.md and verification.md must say plainly that a static shared credential
Expand Down
2 changes: 1 addition & 1 deletion providers/aurora-solar.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,7 +16,7 @@ notes: >
AURORA_SOLAR_WEBHOOK_SECRET (the exact, whole header value, including any 'Bearer ' prefix the
user typed). Look the header up case-insensitively and compare the WHOLE value; do not strip or
parse a 'Bearer ' prefix. This is what Hookdeck's Aurora Solar source does (API key verification:
Header Name + exact whole Header Value). Missing header or mismatch: 401. Compare in constant
API Key Header + exact whole API Key value). Missing header or mismatch: 401. Compare in constant
time: Node checks lengths, then crypto.timingSafeEqual on equal-length Buffers (or on SHA-256
digests of both sides); Python uses hmac.compare_digest on bytes (encode both sides; never pass
str, which raises on non-ASCII). SKILL.md and verification.md must say plainly that a static
Expand Down
3 changes: 1 addition & 2 deletions providers/clickatell.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,8 +14,7 @@ notes: >
CLICKATELL_WEBHOOK_HEADER (default 'Authorization') and the expected value from
CLICKATELL_WEBHOOK_SECRET (the exact, whole header value, including any 'Bearer ' prefix the user
typed). Look the header up case-insensitively and compare the WHOLE value; do not strip or parse a
'Bearer ' prefix. This is what Hookdeck's Clickatell source does (API key verification: Header
Name + exact whole Header Value). Missing header or mismatch: 401. Compare in constant time: Node
'Bearer ' prefix. This is what Hookdeck's Clickatell source does (API key verification: API Key Header + exact whole API Key value). Missing header or mismatch: 401. Compare in constant time: Node
checks lengths, then crypto.timingSafeEqual on equal-length Buffers (or on SHA-256 digests of both
sides); Python uses hmac.compare_digest on bytes (encode both sides; never pass str, which raises
on non-ASCII). SKILL.md and verification.md must say plainly that a static shared credential
Expand Down
7 changes: 4 additions & 3 deletions providers/coterie.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,9 +7,10 @@ notes: >
Small business insurance API (Postman documenter; collection JSON at
docs.coterieinsurance.com/api/collections/8605509/SVn3ra1i). No signature. The only auth is an
opt-in static header named Authentication (not Authorization), turned on by request via your
Coterie contact, sent as 'Authentication: token <guid>'. The key is the WHOLE header value
including the 'token ' prefix: compare the full header to COTERIE_AUTHENTICATION (e.g. 'token
1234-...'), as Hookdeck's Coterie source does. No payload signature. Verify the shared token with
Coterie contact, sent as 'Authentication: token <guid>'. The examples compare the WHOLE header
value, including the 'token ' prefix, to COTERIE_AUTHENTICATION (e.g. 'token 1234-...').
Hookdeck's Coterie source takes the bare GUID in its Token field and accepts the header with or
without 'token '. No payload signature. Verify the shared token with
a constant-time compare (crypto.timingSafeEqual / hmac.compare_digest, hashing both sides or
checking lengths first), like the batch 1 n8n, zapier and brevo skills. The docs define no
event-type strings: webhooks are application, quote and policy payloads with no event field,
Expand Down
2 changes: 1 addition & 1 deletion providers/datacake.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,7 +13,7 @@ notes: >
the expected value from DATACAKE_WEBHOOK_SECRET (the exact, whole header value, including any
'Bearer ' prefix the user typed). Look the header up case-insensitively and compare the WHOLE
value; do not strip or parse a 'Bearer ' prefix. This is what Hookdeck's Datacake source does (API
key verification: Header Name + exact whole Header Value). Missing header or mismatch: 401.
key verification: API Key Header + exact whole API Key value). Missing header or mismatch: 401.
Compare in constant time: Node checks lengths, then crypto.timingSafeEqual on equal-length Buffers
(or on SHA-256 digests of both sides); Python uses hmac.compare_digest on bytes (encode both
sides; never pass str, which raises on non-ASCII). SKILL.md and verification.md must say plainly
Expand Down
3 changes: 1 addition & 2 deletions providers/estuary.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,8 +13,7 @@ notes: >
ESTUARY_WEBHOOK_HEADER (default 'Authorization') and the expected value from
ESTUARY_WEBHOOK_SECRET (the exact, whole header value, including any 'Bearer ' prefix the user
typed). Look the header up case-insensitively and compare the WHOLE value; do not strip or parse a
'Bearer ' prefix. This is what Hookdeck's Estuary source does (API key verification: Header Name +
exact whole Header Value). Missing header or mismatch: 401. Compare in constant time: Node checks
'Bearer ' prefix. This is what Hookdeck's Estuary source does (API key verification: API Key Header + exact whole API Key value). Missing header or mismatch: 401. Compare in constant time: Node checks
lengths, then crypto.timingSafeEqual on equal-length Buffers (or on SHA-256 digests of both
sides); Python uses hmac.compare_digest on bytes (encode both sides; never pass str, which raises
on non-ASCII). SKILL.md and verification.md must say plainly that a static shared credential
Expand Down
2 changes: 1 addition & 1 deletion providers/firstpromoter.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,7 +13,7 @@ notes: >
value from FIRSTPROMOTER_WEBHOOK_SECRET (the exact, whole header value, including any 'Bearer '
prefix the user typed). Look the header up case-insensitively and compare the WHOLE value; do not
strip or parse a 'Bearer ' prefix. This is what Hookdeck's FirstPromoter source does (API key
verification: Header Name + exact whole Header Value). Missing header or mismatch: 401. Compare in
verification: API Key Header + exact whole API Key value). Missing header or mismatch: 401. Compare in
constant time: Node checks lengths, then crypto.timingSafeEqual on equal-length Buffers (or on
SHA-256 digests of both sides); Python uses hmac.compare_digest on bytes (encode both sides; never
pass str, which raises on non-ASCII). SKILL.md and verification.md must say plainly that a static
Expand Down
3 changes: 1 addition & 2 deletions providers/incode.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,8 +14,7 @@ notes: >
header name from INCODE_WEBHOOK_HEADER (default 'Authorization') and the expected value from
INCODE_WEBHOOK_SECRET (the exact, whole header value, including any 'Bearer ' prefix the user
typed). Look the header up case-insensitively and compare the WHOLE value; do not strip or parse a
'Bearer ' prefix. This is what Hookdeck's Incode source does (API key verification: Header Name +
exact whole Header Value). Missing header or mismatch: 401. Compare in constant time: Node checks
'Bearer ' prefix. This is what Hookdeck's Incode source does (API key verification: API Key Header + exact whole API Key value). Missing header or mismatch: 401. Compare in constant time: Node checks
lengths, then crypto.timingSafeEqual on equal-length Buffers (or on SHA-256 digests of both
sides); Python uses hmac.compare_digest on bytes (encode both sides; never pass str, which raises
on non-ASCII). SKILL.md and verification.md must say plainly that a static shared credential
Expand Down
2 changes: 1 addition & 1 deletion providers/ingenious-build.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,7 +15,7 @@ notes: >
INGENIOUS_BUILD_WEBHOOK_SECRET (the exact, whole header value, including any 'Bearer ' prefix the
user typed). Look the header up case-insensitively and compare the WHOLE value; do not strip or
parse a 'Bearer ' prefix. This is what Hookdeck's INGENIOUS.BUILD source does (API key
verification: Header Name + exact whole Header Value). Missing header or mismatch: 401. Compare in
verification: API Key Header + exact whole API Key value). Missing header or mismatch: 401. Compare in
constant time: Node checks lengths, then crypto.timingSafeEqual on equal-length Buffers (or on
SHA-256 digests of both sides); Python uses hmac.compare_digest on bytes (encode both sides; never
pass str, which raises on non-ASCII). SKILL.md and verification.md must say plainly that a static
Expand Down
2 changes: 1 addition & 1 deletion providers/knowbe4.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,7 +13,7 @@ notes: >
expected value from KNOWBE4_WEBHOOK_SECRET (the exact, whole header value, including any 'Bearer '
prefix the user typed). Look the header up case-insensitively and compare the WHOLE value; do not
strip or parse a 'Bearer ' prefix. This is what Hookdeck's KnowBe4 source does (API key
verification: Header Name + exact whole Header Value). Missing header or mismatch: 401. Compare in
verification: API Key Header + exact whole API Key value). Missing header or mismatch: 401. Compare in
constant time: Node checks lengths, then crypto.timingSafeEqual on equal-length Buffers (or on
SHA-256 digests of both sides); Python uses hmac.compare_digest on bytes (encode both sides; never
pass str, which raises on non-ASCII). SKILL.md and verification.md must say plainly that a static
Expand Down
2 changes: 1 addition & 1 deletion providers/lumos.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,7 +16,7 @@ notes: >
(default 'Authorization') and the expected value from LUMOS_WEBHOOK_SECRET (the exact, whole
header value, including any 'Bearer ' prefix the user typed). Look the header up
case-insensitively and compare the WHOLE value; do not strip or parse a 'Bearer ' prefix. This is
what Hookdeck's Lumos source does (API key verification: Header Name + exact whole Header Value).
what Hookdeck's Lumos source does (API key verification: API Key Header + exact whole API Key value).
Missing header or mismatch: 401. Compare in constant time: Node checks lengths, then
crypto.timingSafeEqual on equal-length Buffers (or on SHA-256 digests of both sides); Python uses
hmac.compare_digest on bytes (encode both sides; never pass str, which raises on non-ASCII).
Expand Down
3 changes: 1 addition & 2 deletions providers/onespan.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,8 +7,7 @@ notes: >
E-signature (OneSpan Sign). The callback key registered with the callback URL (POST /api/callback
{url, key, events}) is sent as 'Authorization: Basic {callbackKey}', the raw key, NOT
base64(user:pass), so don't decode it as HTTP Basic. No signature. The credential is the
Authorization header. Hookdeck's OneSpan source compares the WHOLE Authorization header value to
the configured key, so the examples read ONESPAN_AUTHORIZATION = the full value as OneSpan sends
Authorization header. Hookdeck's OneSpan source takes the bare key in its Callback Key field and accepts the header with or without 'Basic '. The examples read ONESPAN_AUTHORIZATION = the full value as OneSpan sends
it (e.g. 'Basic <callback key>'), including the scheme prefix, and compare the whole Authorization
header to it; do not strip or parse the prefix (Coterie pattern). Missing header or mismatch: 401.
Compare in constant time: Node checks lengths, then crypto.timingSafeEqual on equal-length Buffers
Expand Down
3 changes: 1 addition & 2 deletions providers/openclaw.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,8 +7,7 @@ docs:
notes: >
Open-source autonomous AI agent platform. Automations (cron jobs) in webhook
delivery mode POST the finished run event as JSON. Not signed: cron.webhookToken
is sent as Authorization: Bearer <token>, and Hookdeck's OPENCLAW source
compares the whole header value, so verify with a constant-time compare
is sent as Authorization: Bearer <token>, and Hookdeck's OPENCLAW source takes the bare token in its Webhook Token field (with or without 'Bearer '). The examples verify with a constant-time compare
against "Bearer <webhookToken>". Failure alerts in webhook mode use the same
token. Secondary: the Gateway's inbound /hooks/agent and /hooks/wake endpoints,
which the Gateway verifies (hooks.token via Authorization: Bearer or
Expand Down
3 changes: 1 addition & 2 deletions providers/oyster.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,8 +7,7 @@ docs:
notes: >
Global HR/EOR. Webhooks are registered with POST /v1/webhooks {url, sharedSecret}; Oyster sends
the sharedSecret as 'Authorization: Bearer <sharedSecret>' (e.g. 'Bearer 12345'); 5s timeout. No
signature. The credential is the Authorization header. Hookdeck's Oyster source compares the WHOLE
Authorization header value to the configured key, so the examples read OYSTER_AUTHORIZATION = the
signature. The credential is the Authorization header. Hookdeck's Oyster source takes the bare sharedSecret in its Shared Secret field and accepts the header with or without 'Bearer '. The examples read OYSTER_AUTHORIZATION = the
full value as Oyster sends it (e.g. 'Bearer <sharedSecret>'), including the scheme prefix, and
compare the whole Authorization header to it; do not strip or parse the prefix (Coterie pattern).
Missing header or mismatch: 401. Compare in constant time: Node checks lengths, then
Expand Down
2 changes: 1 addition & 1 deletion providers/palmetto-finance.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,7 +17,7 @@ notes: >
PALMETTO_FINANCE_WEBHOOK_SECRET (the exact, whole header value, including any 'Bearer ' prefix the
user typed). Look the header up case-insensitively and compare the WHOLE value; do not strip or
parse a 'Bearer ' prefix. This is what Hookdeck's Palmetto Finance source does (API key
verification: Header Name + exact whole Header Value). Missing header or mismatch: 401. Compare in
verification: API Key Header + exact whole API Key value). Missing header or mismatch: 401. Compare in
constant time: Node checks lengths, then crypto.timingSafeEqual on equal-length Buffers (or on
SHA-256 digests of both sides); Python uses hmac.compare_digest on bytes (encode both sides; never
pass str, which raises on non-ASCII). SKILL.md and verification.md must say plainly that a static
Expand Down
2 changes: 1 addition & 1 deletion providers/particle.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,7 +13,7 @@ notes: >
'Authorization') and the expected value from PARTICLE_WEBHOOK_SECRET (the exact, whole header
value, including any 'Bearer ' prefix the user typed). Look the header up case-insensitively and
compare the WHOLE value; do not strip or parse a 'Bearer ' prefix. This is what Hookdeck's
Particle source does (API key verification: Header Name + exact whole Header Value). Missing
Particle source does (API key verification: API Key Header + exact whole API Key value). Missing
header or mismatch: 401. Compare in constant time: Node checks lengths, then
crypto.timingSafeEqual on equal-length Buffers (or on SHA-256 digests of both sides); Python uses
hmac.compare_digest on bytes (encode both sides; never pass str, which raises on non-ASCII).
Expand Down
2 changes: 1 addition & 1 deletion providers/payrix-pro.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,7 +13,7 @@ notes: >
expected value from PAYRIX_PRO_WEBHOOK_SECRET (the exact, whole header value, including any
'Bearer ' prefix the user typed). Look the header up case-insensitively and compare the WHOLE
value; do not strip or parse a 'Bearer ' prefix. This is what Hookdeck's Payrix Pro source does
(API key verification: Header Name + exact whole Header Value). Missing header or mismatch: 401.
(API key verification: API Key Header + exact whole API Key value). Missing header or mismatch: 401.
Compare in constant time: Node checks lengths, then crypto.timingSafeEqual on equal-length Buffers
(or on SHA-256 digests of both sides); Python uses hmac.compare_digest on bytes (encode both
sides; never pass str, which raises on non-ASCII). SKILL.md and verification.md must say plainly
Expand Down
3 changes: 1 addition & 2 deletions providers/plunk.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,8 +13,7 @@ notes: >
the header name from PLUNK_WEBHOOK_HEADER (default 'Authorization') and the expected value from
PLUNK_WEBHOOK_SECRET (the exact, whole header value, including any 'Bearer ' prefix the user
typed). Look the header up case-insensitively and compare the WHOLE value; do not strip or parse a
'Bearer ' prefix. This is what Hookdeck's Plunk source does (API key verification: Header Name +
exact whole Header Value). Missing header or mismatch: 401. Compare in constant time: Node checks
'Bearer ' prefix. This is what Hookdeck's Plunk source does (API key verification: API Key Header + exact whole API Key value). Missing header or mismatch: 401. Compare in constant time: Node checks
lengths, then crypto.timingSafeEqual on equal-length Buffers (or on SHA-256 digests of both
sides); Python uses hmac.compare_digest on bytes (encode both sides; never pass str, which raises
on non-ASCII). SKILL.md and verification.md must say plainly that a static shared credential
Expand Down
2 changes: 1 addition & 1 deletion providers/rebrandly.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,7 +15,7 @@ notes: >
expected value from REBRANDLY_WEBHOOK_SECRET (the exact, whole header value, including any 'Bearer
' prefix the user typed). Look the header up case-insensitively and compare the WHOLE value; do
not strip or parse a 'Bearer ' prefix. This is what Hookdeck's Rebrandly source does (API key
verification: Header Name + exact whole Header Value). Missing header or mismatch: 401. Compare in
verification: API Key Header + exact whole API Key value). Missing header or mismatch: 401. Compare in
constant time: Node checks lengths, then crypto.timingSafeEqual on equal-length Buffers (or on
SHA-256 digests of both sides); Python uses hmac.compare_digest on bytes (encode both sides; never
pass str, which raises on non-ASCII). SKILL.md and verification.md must say plainly that a static
Expand Down
Loading
Loading