Skills

Chapter 22 of 28

Encore Go Webhook

Receive inbound webhooks from external services (Stripe, GitHub, Slack, Twilio, etc.) in Encore Go using //encore:api raw.

1 minute · 204 words · 7 sections

Use //encore:api raw to receive inbound webhooks from third-party services. Raw endpoints give you direct access to http.ResponseWriter and *http.Request, which you need for signature verification (the verification typically requires the unparsed raw body).

1. Define the endpoint with `//encore:api raw`

package webhooks

import (
    "io"
    "net/http"
)

//encore:api public raw path=/webhooks/stripe method=POST
func StripeWebhook(w http.ResponseWriter, req *http.Request) {
    sig := req.Header.Get("Stripe-Signature")

    // Read the raw body — needed for signature verification.
    body, err := io.ReadAll(req.Body)
    if err != nil {
        http.Error(w, "could not read body", http.StatusBadRequest)
        return
    }

    // Verify signature, parse event, handle, then respond...

    w.Header().Set("Content-Type", "application/json")
    w.WriteHeader(http.StatusOK)
    w.Write([]byte(`{"received":true}`))
}

2. Verify the signature

Most providers sign webhooks. Read the secret with secrets (see the encore-go-secret skill) and verify before trusting the payload.

package webhooks

import (
    "github.com/stripe/stripe-go/v76/webhook"
)

var secrets struct {
    StripeWebhookSecret string
}

//encore:api public raw path=/webhooks/stripe method=POST
func StripeWebhook(w http.ResponseWriter, req *http.Request) {
    body, _ := io.ReadAll(req.Body)
    sig := req.Header.Get("Stripe-Signature")

    event, err := webhook.ConstructEvent(body, sig, secrets.StripeWebhookSecret)
    if err != nil {
        http.Error(w, "signature verification failed", http.StatusBadRequest)
        return
    }

    // event is now trusted — handle it.
    _ = event
    w.WriteHeader(http.StatusOK)
}

For GitHub, verify the HMAC-SHA256 in the X-Hub-Signature-256 header against the raw body using your webhook secret.

Common providers

Provider	Signature header	Verification
Stripe	`Stripe-Signature`	`stripe.webhook.ConstructEvent(rawBody, sig, secret)`
GitHub	`X-Hub-Signature-256`	HMAC-SHA256 over the raw body
Slack	`X-Slack-Signature`	HMAC-SHA256 over `v0:{timestamp}:{rawBody}`
Shopify	`X-Shopify-Hmac-Sha256`	HMAC-SHA256 (base64) over the raw body
Twilio	`X-Twilio-Signature`	HMAC-SHA1 over URL + sorted form fields

Always respond quickly

Webhook senders retry on non-2xx or slow responses. Acknowledge with a 2xx as soon as the payload is verified, then enqueue the actual work via Pub/Sub (see encore-go-pubsub) instead of doing it in the request handler.

package webhooks

import (
    "encore.dev/pubsub"
    "net/http"
)

type StripeEvent struct {
    ID   string `json:"id"`
    Type string `json:"type"`
    Data any    `json:"data"`
}

var StripeEvents = pubsub.NewTopic[*StripeEvent]("stripe-events", pubsub.TopicConfig{
    DeliveryGuarantee: pubsub.AtLeastOnce,
})

//encore:api public raw path=/webhooks/stripe method=POST
func StripeWebhook(w http.ResponseWriter, req *http.Request) {
    // ... verify signature, parse event ...

    _, _ = StripeEvents.Publish(req.Context(), &StripeEvent{
        ID: event.ID, Type: string(event.Type), Data: event.Data,
    })
    w.WriteHeader(http.StatusOK)
}

Guidelines

Use //encore:api raw only for webhooks and other low-level HTTP integrations.
Always verify the provider’s signature before trusting the payload.
Always respond 2xx fast — push slow work onto Pub/Sub.
Store the signing secret in secrets struct{...}; never inline it.
For typed JSON endpoints in your own service, use plain //encore:api from the encore-go-api skill.

Install this repository

$ npx skills add encoredev/skills

» /plugin marketplace add encoredev/skills

Skills install per repository, not per chapter — the CLI has no documented per-skill form, so we do not print one.

About this skill

Trigger

Receive inbound webhooks from external services (Stripe, GitHub, Slack, Twilio, etc.) in Encore Go using `//encore:api raw`. The right skill any time the user names a third-party provider that POSTs events to a URL you own.

The verbatim description from this skill’s front matter — the string an agent matches on to decide whether to load it.

Colophon for this issue

Colophon

How this issue was made

Source

github.com/encoredev/skills, branch main, last pushed 15 May 2026.

Licence

Apache-2.0 — the text of every chapter is reproduced unmodified, frontmatter included, under the upstream licence.

Discovery

28 chapters found by walking the repository tree for SKILL.md, not by matching a directory convention. One layout observed: encore/*/SKILL.md.

Issue colours

Resolved from a deterministic hash of the owner name. Two accent tones are generated per issue and each is proven against its own ground before it ships: a single accent that passes AA on both light and dark paper is arithmetically impossible.

Heading repairs

1 repair applied to this chapter so the document has one h1 and no skipped levels:

Shifted “7 headings” from h1 to h2 so the chapter title is the only h1.

Spec compliance

28 editorial notes across 28 of 28 chapters. They are printed in the margin of each chapter rather than as errors here.

Encore API — 1 note
Encore Auth — 1 note
Encore Bucket — 1 note
Encore Cache — 1 note
Encore Code Review — 1 note
Encore Cron — 1 note
Encore Database — 1 note
Encore Frontend — 1 note
Encore Getting Started — 1 note
Encore Go API — 1 note

and 18 more.

Images

Images inside a chapter come from the upstream repository. Where the author gave no alternative text we mark the image decorative rather than inventing a description — a plausible caption we made up is worse than none for the reader who depends on it.

Marketplace

A plugin manifest is published at .claude-plugin/marketplace.json by Encore, declaring 1 plugin. It is read for editorial metadata only — never as the skill index, which is always the repository tree.

Signal

Install counts come from skills.sh. They measure downloads, not quality, and an unranked repository is not an unread one.

Agent surfaces

The whole issue is available as one markdown document at /encoredev/skills.md, and each chapter at its own .md URL.

Publication

Set by Skills Docs from the source repository. Body text is Literata at the reader’s chosen size and measure; code is Geist Mono. Nothing on this page was written by us except this paragraph.

Encore Go Webhook Endpoints

package webhooks

import (
    "io"
    "net/http"
)

//encore:api public raw path=/webhooks/stripe method=POST
func StripeWebhook(w http.ResponseWriter, req *http.Request) {
    sig := req.Header.Get("Stripe-Signature")

    // Read the raw body — needed for signature verification.
    body, err := io.ReadAll(req.Body)
    if err != nil {
        http.Error(w, "could not read body", http.StatusBadRequest)
        return
    }

    // Verify signature, parse event, handle, then respond...

    w.Header().Set("Content-Type", "application/json")
    w.WriteHeader(http.StatusOK)
    w.Write([]byte(`{"received":true}`))
}

Most providers sign webhooks. Read the secret with secrets (see the encore-go-secret skill) and verify before trusting the payload.

package webhooks

import (
    "github.com/stripe/stripe-go/v76/webhook"
)

var secrets struct {
    StripeWebhookSecret string
}

//encore:api public raw path=/webhooks/stripe method=POST
func StripeWebhook(w http.ResponseWriter, req *http.Request) {
    body, _ := io.ReadAll(req.Body)
    sig := req.Header.Get("Stripe-Signature")

    event, err := webhook.ConstructEvent(body, sig, secrets.StripeWebhookSecret)
    if err != nil {
        http.Error(w, "signature verification failed", http.StatusBadRequest)
        return
    }

    // event is now trusted — handle it.
    _ = event
    w.WriteHeader(http.StatusOK)
}

For GitHub, verify the HMAC-SHA256 in the X-Hub-Signature-256 header against the raw body using your webhook secret.

Provider	Signature header	Verification
Stripe	`Stripe-Signature`	`stripe.webhook.ConstructEvent(rawBody, sig, secret)`
GitHub	`X-Hub-Signature-256`	HMAC-SHA256 over the raw body
Slack	`X-Slack-Signature`	HMAC-SHA256 over `v0:{timestamp}:{rawBody}`
Shopify	`X-Shopify-Hmac-Sha256`	HMAC-SHA256 (base64) over the raw body
Twilio	`X-Twilio-Signature`	HMAC-SHA1 over URL + sorted form fields

package webhooks

import (
    "encore.dev/pubsub"
    "net/http"
)

type StripeEvent struct {
    ID   string `json:"id"`
    Type string `json:"type"`
    Data any    `json:"data"`
}

var StripeEvents = pubsub.NewTopic[*StripeEvent]("stripe-events", pubsub.TopicConfig{
    DeliveryGuarantee: pubsub.AtLeastOnce,
})

//encore:api public raw path=/webhooks/stripe method=POST
func StripeWebhook(w http.ResponseWriter, req *http.Request) {
    // ... verify signature, parse event ...

    _, _ = StripeEvents.Publish(req.Context(), &StripeEvent{
        ID: event.ID, Type: string(event.Type), Data: event.Data,
    })
    w.WriteHeader(http.StatusOK)
}

Use //encore:api raw only for webhooks and other low-level HTTP integrations.

Always verify the provider’s signature before trusting the payload.

Always respond 2xx fast — push slow work onto Pub/Sub.

Store the signing secret in secrets struct{...}; never inline it.

For typed JSON endpoints in your own service, use plain //encore:api from the encore-go-api skill.

Encore Go Webhook