GitHub Webhook Specs, Events, and Examples

GitHub uses webhooks to notify third-party apps of github events — such as when an issue is created, a branch is created, or when a pull request is approved. Github events can be used to trigger action in other systems such as an external issue tracker, initiate CI builds, update a backup mirror, or even deploy to your production servers.


Supported Events

Security Headers

  • Signature Header: X-Hub-Signature-256
  • Hash: sha256
  • Encode: hex
  • payload: request_body


SDKs and Sample Code

Sample Validation

const crypto = require('crypto')
const sigHeader = 'X-Hub-Signature-256'
const hashAlgo = 'sha256'
const encode = 'hex'
const hmacSecret = process.env.WEBHOOK_SECRET'/github-webhook', (req, res) => {
  //01: Validate signature
  const message = req.body
  const digest = 'sha256='+
                  crypto.createHmac(hashAlgo, hmacSecret)
  if (request.headers[sigHeader] !== digest) {
      res.status(401).send('Request unauthorized')
      //02: Process message
      res.json({ message: "Success" })