webhook-handler-patterns

A guide for building webhook handlers, which are server endpoints that receive event messages from other services. It follows the order: verify the message, read its contents, then process it safely once.

In plain words
What is it for?
Use it when implementing webhook receivers with Express, Next.js, or FastAPI, including message verification, duplicate-event protection, error handling, and retry behavior.
Why use it?
It helps avoid accepting forged messages, processing the same event repeatedly, or mishandling failures and provider retries.

Skill for Claude CodeCodex

Part of the brana plugin — 18 skills, 4 commands, 14 agents, 13 hooks shipped together

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods
npx agentmods add skills/martineserios/thebrana/webhook-handler-patterns
Any agent
npx skills add martineserios/thebrana --skill webhook-handler-patterns
Clone the repo
git clone --depth 1 https://github.com/martineserios/thebrana

Made for: Claude Code, Codex.

Or install brana, the plugin that ships this one along with the rest of its 18 skills, 4 commands, 14 agents, 13 hooks.

Per session 52 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.
When invoked 677 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 0 findings. Scan, not verified.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5 $0.00052 $0.00677
Opus 5 $0.00026 $0.00338
Sonnet 5 $0.00010 $0.00135
Haiku 4.5 $0.00005 $0.00068

Measured 3d ago against content hash 07eb771a3753, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade A, and why

webhook-handler-patterns scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 3d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

system/skills/acquired/webhook-handler-patterns/SKILL.md · 69 lines

How it starts

The opening of the file, as written. The whole thing — 69 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Webhook Handler Patterns

When to Use This Skill

  • Following the correct webhook handler order (verify → parse → handle idempotently)
  • Implementing idempotent webhook handlers
  • Handling errors and configuring retry behavior
  • Understanding framework-specific gotchas (raw body, middleware order)
  • Building production-ready webhook infrastructure

Resources

Handler Sequence

  • references/handler-sequence.md (upstream references/handler-sequence.md, not installed locally) - Verify first, parse second, handle idempotently third

Best Practices

  • references/idempotency.md (upstream references/idempotency.md, not installed locally) - Prevent duplicate processing
  • references/error-handling.md (upstream references/error-handling.md, not installed locally) - Return codes, logging, dead letter queues
  • references/retry-logic.md (upstream references/retry-logic.md, not installed locally) - Provider retry schedules, backoff patterns

Framework Guides

  • references/frameworks/express.md (upstream references/frameworks/express.md, not installed locally) - Express.js patterns and gotchas
  • references/frameworks/nextjs.md (upstream references/frameworks/nextjs.md, not installed locally) - Next.js App Router patterns
  • references/frameworks/fastapi.md (upstream references/frameworks/fastapi.md, not installed locally) - FastAPI/Python patterns

Quick Reference

Handler Sequence

  1. Verify signature first — Use raw body; reject invalid requests with 4xx.
  2. Parse payload second — After verification, parse or construct the event.
  3. Handle idempotently third — Check event ID, then process; return 2xx for duplicates.

Response Codes

Code Meaning Provider Behavior
2xx Success No retry
4xx Client error Usually no retry (except 429)
5xx Server error Retry with backoff
429 Rate limited Retry after delay

Idempotency Checklist

  1. Extract unique event ID from payload
  2. Check if event was already processed
  3. Process event within transaction
  4. Store event ID after successful processing
  5. Return success for duplicate events

Read the full file on GitHub · 69 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 3d ago First seen · 69 lines · 52 tokens per session scan A 07eb771a3753

Subscribe to this mod's changes

webhook-handler-patterns is a skill published in the GitHub repository martineserios/thebrana (3 stars, last pushed 3d ago), licensed MIT. It adds 52 tokens to every session and 677 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.

Related

Other skills, from other repositories

webhook-subscriptions

Design, implement, and debug webhook integrations with security and reliability.

furkangonel/cowrangler · 18 tokens

background-task

Add or modify work that runs outside the request/response cycle — emails, document ingestion, webhooks, cleanups, scheduled jobs. Use when something is slow or fire-and-forget, or when adding a periodic/cron task. This project's queue is {{ cookiecutter.backgroundtasks }}.

vstorm-co/full-stack-ai-agent-template · 62 tokens

agent-tool

Add a new tool/function the AI agent can call (e.g. look something up, hit an external API, perform an action). Use when extending the assistant's capabilities, wiring a new function into the agent, or when the model needs a new action. This project uses {{ cookiecutter.aiframework }}.

vstorm-co/full-stack-ai-agent-template · 66 tokens

frontend-feature

Build a new page, view, or data-driven feature in the Next.js frontend. Use when adding a route under the dashboard/marketing area, wiring UI to a backend endpoint, adding client state, or creating a localized page. Covers App Router, data fetching, Zustand stores, and i18n.

vstorm-co/full-stack-ai-agent-template · 64 tokens

pytest-suite

Write or extend the backend test suite following this project's conventions. Use when adding tests for a new service/route/repository, when coverage is missing, or when asked to test a feature. Knows the mocked-session + httpx AsyncClient setup so tests run with no database.

vstorm-co/full-stack-ai-agent-template · 59 tokens

rag-knowledge

Work with the RAG knowledge base — ingest documents, run semantic search, manage collections, or add a sync source/connector (Google Drive, S3). Use when populating or debugging the knowledge base, tuning retrieval, or adding a new document source. This project uses {{ cookiecutter.vectorstore }} + {{…

vstorm-co/full-stack-ai-agent-template · 76 tokens