GitHub Webhook Specs, Events, and Examples

GitHub uses webhooks to notify third-party apps of github events — such as when an issue is created, a branch is created, or when a pull request is approved. Github events can be used to trigger action in other systems such as an external issue tracker, initiate CI builds, update a backup mirror, or even deploy to your production servers.

Sample Validation

GitHub expects a 2xx response within 10 seconds and does not retry failed deliveries automatically. See Retries and Timeouts.

const crypto = require('crypto')
const express = require('express')
const app = express()


const sigHeader = 'X-Hub-Signature-256'
const hashAlgo = 'sha256'
const encode = 'hex'
const hmacSecret = process.env.WEBHOOK_SECRET


// Use the raw body: re-serialized JSON will not match the signature
app.post('/github-webhook', express.raw({ type: 'application/json' }), (req, res) => {
  //01: Validate signature
  const digest = Buffer.from('sha256=' +
                  crypto.createHmac(hashAlgo, hmacSecret)
                  .update(req.body).digest(encode), 'utf8')
  const providerSig = Buffer.from(req.get(sigHeader) || '', 'utf8')
  if (providerSig.length !== digest.length || !crypto.timingSafeEqual(digest, providerSig)) {
      return res.status(401).send('Request unauthorized')
  }
  //02: Process message (dedupe on X-GitHub-Delivery)
  res.json({ message: "Success" })
})