Webhooks
Get an HTTP POST when issues, comments, projects and other data change.
A webhook sends a POST to your URL when issues, comments, projects and other data are created, updated or removed. Create them in Settings › API.
Verify each request
Every request is signed. Compare the Linear-Signature header with the HMAC-SHA256 of the raw body under the webhook's
signing secret, and reject old webhookTimestamps:
import { createHmac, timingSafeEqual } from 'node:crypto';
function verify(rawBody: Buffer, signature: string, secret: string) {
const expected = createHmac('sha256', secret).update(rawBody).digest();
const received = Buffer.from(signature, 'hex');
if (received.length !== expected.length || !timingSafeEqual(received, expected)) return false;
const { webhookTimestamp } = JSON.parse(rawBody.toString());
return Math.abs(Date.now() - webhookTimestamp) < 60_000;
}