Configure and handle Linear webhooks for real-time event processing. Use when setting up webhooks, handling Linear events, or building real-time integrations. Trigger with phrases like "linear webhooks", "linear events", "linear real-time", "handle linear webhook", "linear webhook setup".
Build an ingress path that proves authenticity on raw bytes, acknowledges quickly, and makes downstream processing replay-safe.
Use Read, Glob, and Grep to inspect code, configuration, and evidence. Use WebFetch only for current first-party Linear documentation and package metadata. Use Write or Edit only for requested implementation with known target files. Never write credentials, customer content, unrestricted environment output, or unredacted GraphQL variables.
Linear-Signature is the hex HMAC-SHA256 of the exact raw body; Linear-Delivery is the unique delivery UUID and Linear-Timestamp is epoch milliseconds.admin scope can create or read webhooks.LinearWebhookClient, including raw-body signature verification and framework handlers.Use a personal API key only for owner-controlled scripts, OAuth with PKCE for user-delegated applications, or an enabled client-credentials grant for approved automation. Personal keys use Authorization: <API_KEY>; OAuth tokens use Authorization: Bearer <ACCESS_TOKEN>. Store credentials server-side in an approved secret manager.
Treat app approval, team access, scope changes, credential creation, rotation, revocation, and production access as owner-approved actions.
Linear-Delivery, enqueue the verified envelope, and return 200 within five seconds.action, type, entity ID, updatedFrom, organization, and webhook ID as appropriate.Do not create, reveal, rotate, or revoke credentials; authorize an OAuth app; change scopes or team access; create, mutate, archive, or delete workspace data; configure or re-enable webhooks; import or export data; change roles, SCIM, or audit streaming; transmit diagnostics; change paid entitlements; or perform another production mutation without explicit approval from the accountable owner. Keep diagnosis read-only unless implementation was requested.
Return the workspace and team scope, auth mode without credential value, files and contracts inspected, exact operation names, evidence collected, validation result, sensitive fields redacted, remaining risk, accountable owner, approval state, and rollback or next action.
| Condition | Response | |---|---| | Signature mismatch | Return non-200, do not parse into business logic, and verify raw-body/secret selection. | | Processing exceeds five seconds | Queue after verification and acknowledge before doing business work. | | Duplicate delivery | Return 200 after recording the dedupe hit; do not repeat side effects. | | Webhook disabled | Repair the endpoint, manually re-enable after approval, then reconcile the missed interval. |
Use a compact handoff that makes scope, mutation authority, and verification evidence reviewable.
Input:
scope=team; events=Issue,Comment; raw-body=true; queue=durable
Expected handoff:
signature=verified; ack<5s; dedupe=delivery-id; reconciliation=enabled
下载完整 Skill 目录，包含 SKILL.md 及所有相关文件
Search for places (restaurants, cafes, etc.) via Google Places API proxy on localhost.
Interact with GitHub using the `gh` CLI. Use `gh issue`, `gh pr`, `gh run`, and `gh api` for issues, PRs, CI runs, and advanced queries.
Create or update AgentSkills. Use when designing, structuring, or packaging skills with scripts, references, and assets.
Start voice calls via the OpenClaw voice-call plugin.
Notion API for creating and managing pages, databases, and blocks.
Gemini CLI for one-shot Q&A, summaries, and generation.
Category:developer