airtable-webhooks

Airtable Webhooks

When to Use This Skill

• Setting up Airtable webhook handlers
• How do I verify the X-Airtable-Content-MAC signature?
• Why is my Airtable webhook signature verification failing?
• How do I fetch the actual changes after an Airtable notification?
• Handling base changes: tableData, tableFields, tableMetadata with add/remove/update

The Thin-Ping Model (Read This First)

Airtable webhooks are a two-step, thin-ping design and do not follow the Standard Webhooks spec:

1. Notification POST — Airtable POSTs a tiny body to your notificationUrl containing only which base/webhook changed and a timestamp. No change data.

   { "base": { "id": "appABC" }, "webhook": { "id": "achXYZ" }, "timestamp": "2022-02-01T21:25:05.663Z" }
   

   You must respond 200 or 204 with an empty body within 25 seconds.

2. Fetch payloads — To get the actual changes, call GET /v0/bases/{baseId}/webhooks/{webhookId}/payloads with a persisted cursor (a monotonically increasing transaction number). The response returns payloads, the next cursor, and mightHaveMore (loop while true; max limit is 50).

Verification (core)

Airtable signs the raw notification body with HMAC-SHA256, keyed on the base64-decoded macSecretBase64 returned once at webhook creation. The digest is hex and the header value is prefixed with hmac-sha256=.

Node:

const crypto = require('crypto');

function verify(rawBody, macHeader, macSecretBase64) {
  if (!macHeader) return false;
  const key = Buffer.from(macSecretBase64, 'base64');
  const expected = 'hmac-sha256=' + crypto.createHmac('sha256', key).update(rawBody).digest('hex');
  try {
    return crypto.timingSafeEqual(Buffer.from(macHeader), Buffer.from(expected));
  } catch {
    return false; // length mismatch = invalid
  }
}

Python:

import hmac, hashlib, base64

def verify(raw_body: bytes, mac_header: str, mac_secret_base64: str) -> bool:
    if not mac_header:
        return False
    key = base64.b64decode(mac_secret_base64)
    expected = "hmac-sha256=" + hmac.new(key, raw_body, hashlib.sha256).hexdigest()
    return hmac.compare_digest(mac_header, expected)