Skip to main content
POST
GitHub Marketplace webhook receiver

Headers

X-Hub-Signature-256
string
required

HMAC-SHA256 of the raw request body, prefixed with sha256=.

X-GitHub-Event
string

GitHub event type. Only marketplace_purchase is acted on; everything else is logged and acknowledged.

X-GitHub-Delivery
string

Per-delivery UUID assigned by GitHub (for log correlation).

Body

application/json

Raw GitHub Marketplace payload. The handler reads req.body as a Buffer and JSON-parses after signature verification. See GitHub's marketplace_purchase documentation for the full shape.

action
enum<string>
Available options:
purchased,
changed,
cancelled,
pending_change,
pending_change_cancelled
Example:

"purchased"

effective_date
string<date-time>
sender
object
marketplace_purchase
object

Response

Webhook accepted. The handler always returns 200 once the signature passes — even if the downstream business logic threw — so GitHub does not retry. On internal failures the response includes error.

received
boolean
Example:

true

error
string

Present only when post-signature processing threw.