community-webhooks

Community Webhooks

Webhooks from Community (community.com) — the SMS / conversational-messaging platform for brands and creators. This is not a generic community-forum product, not Circle/Discourse/Bettermode, and not Salesforce Experience Cloud. The developer hub is https://developer.community.com.

When to Use This Skill

• How do I receive Community webhooks?
• How do I verify the community-signature header?
• Why is my Community webhook signature verification failing?
• How do I handle message.inbound / message.outbound events?
• How do I handle member.created, member.updated, and member.deleted events?
• How do I deduplicate Community webhooks (at-least-once delivery)?

Verification (core)

Community signs every request with HMAC-SHA256 over {timestamp}.{raw_body} and sends the result in a Stripe-style community-signature header:

community-signature: t=1711666033,v1=b777f6ae2497ae95e99811c88b28d8ba377c95d615905963c68fae4c800de48d

The HMAC key is the signature secret, which is unique to each webhook (Dashboard → Settings → Integrations → Webhooks). It is not your community_api-prefixed Async REST API token. Always HMAC the raw request body — re-serializing the JSON changes the bytes and breaks the signature.

const crypto = require('crypto');

function verifyCommunitySignature(rawBody, signatureHeader, secret) {
  if (!signatureHeader || !secret) return false;

  // Parse "t=...,v1=..." without assuming field order
  const fields = Object.fromEntries(
    signatureHeader.split(',').map((p) => {
      const i = p.indexOf('=');
      return i === -1 ? ['', ''] : [p.slice(0, i).trim(), p.slice(i + 1).trim()];
    })
  );
  const timestamp = fields.t;
  const signature = fields.v1; // only the v1 scheme is supported
  if (!timestamp || !signature) return false;

  // Signed content is: timestamp + "." + raw body
  const expected = crypto
    .createHmac('sha256', secret)
    .update(`${timestamp}.${rawBody}`, 'utf8')
    .digest('hex');

  try {
    return crypto.timingSafeEqual(Buffer.from(signature), Buffer.from(expected));
  } catch {
    return false; // length mismatch
  }
}