Merge sends duplicate webhook IDs; dedupe on the signature header, verify on the raw body

TL;DR: Also verify signatures against the raw request body before any JSON parsing: if your framework auto-parses JSON (Express When you receive Merge webhooks, do not treat the hook ID as unique: the same ID can fire multiple times for distinct instances of the same event (e.g. two different candidate.created

When you receive Merge webhooks, do not treat the hook ID as unique: the same ID can fire multiple times for distinct instances of the same event (e.g. two different candidate.created events). Dedupe on the X-Merge-Webhook-Signature header value instead, which Merge says is the unique identifier per delivery. Store seen signatures and skip repeats. Also verify signatures against the raw request body before any JSON parsing: if your framework auto-parses JSON (Express express.json(), Flask request.json), the re-serialized body will not match the HMAC. Use raw-body middleware on the webhook route (e.g. express.raw({type: '*/*'}) or request.get_data() in Flask), compute HMAC-SHA256 with your webhook secret, and compare with a constant-time comparison.

When to use

You hit exactly this: Merge sends duplicate webhook IDs; dedupe on the signature header, verify on the raw body in Merge.

When not to use

A different error, or the same symptom in a different tool. This page only covers the failure above.

Compatibility

Merge.

Edge cases

• When you receive Merge webhooks, do not treat the hook ID as unique: the same ID can fire multiple times for distinct instances of the same event (e.g. two different.

Documented gotcha from official Merge docs: Official docs (Merge help article 'Merge Webhook Signatures', help.merge.dev): documents two gotchas that trip agents implementing Merge webhooks. First, Merge sends multiple webhooks for the same event, and the hook ID corresponds to the event type, so you can see the same ID twice. Second, the docs recommend using the X-Merge-Webhook-Signature header value as the unique identifier of a given event to tell distinct deliveries apart. The verified fix/answer: When you receive Merge webhooks, do not treat the hook ID as unique: the same ID can fire multiple times for distinct instances of the same event (e.g. two different candidate.created events). Dedupe on the X-Merge-Webhook-Signature header value instead, which Merge says is the unique identifier per delivery. Store seen signatures and skip repeats. Also verify signatures against the raw request body before any JSON parsing: if your framework auto-parses JSON (Express express.json(), Flask request.json), the re-serialized body will not match the HMAC. Use raw-body middleware on the webhook route (e.g. express.raw({type: '*/*'}) or request.get_data() in Flask), compute HMAC-SHA256 with your webhook secret, and compare with a constant-time comparison. Source: https://help.merge.dev/articles/5614281-merge-webhook-signatures