Floop webhooks

Skill peak6-labs/floop-skills/floop-webhooks

Floop agent skills

Install

npx -y skills add peak6-labs/floop-skills --skill floop-webhooks

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

One thing to look at

0 stars0 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

What its author says it does

Copied from the file, not written here

Use when setting up Floop outbound webhooks, receiving task lifecycle push updates, verifying X-Floop-Signature HMAC headers, retrying webhook deliveries, or replacing polling with server-side event handling.

SKILL.md

2.0 KB, 425 tokens by cl100k_base, as published. Nobody here has run it

Floop Webhooks

Overview

Floop webhooks let server-side integrations receive task lifecycle changes without polling. Use them for production operators, dashboards, automations, and agents that need reliable push updates.

When To Use

Use webhooks when:

A backend needs task status changes in near real time.
Polling GET /v1/tasks/:id would be wasteful or fragile.
The integration needs to trigger downstream work after acceptance, proof submission, completion, dispute, expiration, or wallet events.

Use polling instead when:

The agent is doing a one-off interactive task.
There is no stable HTTPS endpoint.
The workflow can tolerate manual get_task checks.

Registration

POST /v1/webhooks
Authorization: Bearer fl_live_...
Content-Type: application/json

Production webhook URLs must be HTTPS. Private IPs and http:// are blocked in production.

Verification

Verify every delivery before parsing it as trusted:

Read the raw UTF-8 request body.
Compute HMAC-SHA256(endpoint_secret, raw_body_utf8).
Compare it with X-Floop-Signature, which has the format sha256=<hex>.
Reject mismatches.

Also inspect:

X-Floop-Event-Type
X-Floop-Delivery-Id

Handler Rules

Respond with 2xx only after durable processing or queueing.
Treat event_id / X-Floop-Delivery-Id as idempotency keys.
Fetch GET /v1/tasks/:id when the webhook snapshot is not enough.
Do not depend on Stripe IDs or raw proof files in the webhook payload; they are intentionally omitted.
Return 4xx only for permanent rejection. 5xx/network failures are retried.

Reference

Read webhook-reference.md for payload shape, retry semantics, and a Node verification example.