whatnot-webhooks

Whatnot Webhooks

Whatnot (whatnot.com) is a live-shopping marketplace where sellers run livestream auctions and buy-it-now sales. This skill covers webhooks from the Whatnot Seller API (developers.whatnot.com), a GraphQL API that Whatnot describes as being in development preview.

Canonical docs: Webhooks overview. The docs site renders its code blocks with JavaScript, so a plain HTTP fetch of the page shows the prose but not the envelope, headers or sample code. Open it in a browser.

When to Use This Skill

• How do I receive Whatnot webhooks?
• How do I verify X-Whatnot-Webhook-Signature?
• Why does my Whatnot signature check fail?
• How do I handle order/created, product/sold or livestream/stopped?
• How do I subscribe to a Whatnot webhook topic?
• Does Whatnot retry failed webhooks?

Verification (core)

HMAC-SHA256 over the raw request body bytes, keyed with your app's webhook secret key, sent as a lowercase hex digest in X-Whatnot-Webhook-Signature. Nothing else is signed: no timestamp, no prefix, no field concatenation.

const crypto = require('crypto');

function verifyWhatnotSignature(rawBody, signature, secret) {
  if (!signature || !secret) return false;                  // fail closed
  const received = signature.trim().toLowerCase();          // hex is case-insensitive
  if (!/^[0-9a-f]{64}$/.test(received)) return false;      // also guards timingSafeEqual's length check
  const expected = crypto
    .createHmac('sha256', secret)                           // the webhook secret, as-is
    .update(rawBody)                                        // RAW bytes, never re-serialized JSON
    .digest('hex');
  return crypto.timingSafeEqual(Buffer.from(received, 'hex'), Buffer.from(expected, 'hex'));
}

Whatnot's own sample (Python, from the overview page) is the same computation:

calculated_signature = hmac.new(
    bytes(secret, 'utf-8'), bytes(raw_request_body, 'utf-8'), hashlib.sha256
).hexdigest()
return calculated_signature == signature