> ## Documentation Index
> Fetch the complete documentation index at: https://bobprince-78964c2b.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# GitHub

> Capture and inspect GitHub webhook events with Hookdrop.

Use Hookdrop as your GitHub webhook URL to capture repository events — pushes, pull requests, issues, releases, and workflow runs — and inspect every payload in real time.

## Setup

<Steps>
  <Step title="Open webhook settings">
    Go to your GitHub repository, then navigate to **Settings → Webhooks**.
  </Step>

  <Step title="Add a webhook">
    Click **Add webhook**.
  </Step>

  <Step title="Paste your Hookdrop URL">
    Enter your capture URL in the **Payload URL** field:

    ```
    https://hookdrop.dev/in/{your-token}
    ```

    Replace `{your-token}` with the token shown on your Hookdrop dashboard.
  </Step>

  <Step title="Set the content type">
    Change **Content type** to `application/json`. This ensures Hookdrop receives a structured JSON body you can inspect directly.
  </Step>

  <Step title="Select events">
    Choose **Let me select individual events** and check the events relevant to your integration, or select **Send me everything** to capture all activity.
  </Step>

  <Step title="Save the webhook">
    Click **Add webhook**. GitHub fires a `ping` event immediately — it appears in your Hookdrop dashboard within seconds to confirm the connection is working.
  </Step>
</Steps>

<Note>
  GitHub sends a `ping` event when you first register a webhook. You don't need to handle it explicitly — Hookdrop captures it automatically so you can confirm delivery.
</Note>

## Common events

| Event          | When it fires                               |
| -------------- | ------------------------------------------- |
| `push`         | Code is pushed to any branch                |
| `pull_request` | A pull request is opened, closed, or merged |
| `issues`       | An issue is opened or closed                |
| `release`      | A new release is published                  |
| `workflow_run` | A GitHub Actions workflow completes         |

## Signature verification

GitHub signs every webhook request with an `X-Hub-Signature-256` header. Verify it in your handler before processing any event.

```typescript github-webhook.ts theme={null}
import crypto from 'crypto'

const verifyGitHubWebhook = (
  payload: string,
  signature: string,
  secret: string
): boolean => {
  const expected = `sha256=${crypto
    .createHmac('sha256', secret)
    .update(payload)
    .digest('hex')}`

  return crypto.timingSafeEqual(
    Buffer.from(expected),
    Buffer.from(signature)
  )
}
```

Set your webhook secret in GitHub under **Settings → Webhooks → \[your webhook] → Secret**. Use the same value in your handler.

<Warning>
  Use `crypto.timingSafeEqual` rather than `===` to compare signatures. Direct string comparison is vulnerable to timing attacks.
</Warning>

## Testing locally

<Tip>
  Point your GitHub webhook at your Hookdrop URL during development. Every push, PR, or issue event is captured and stored — you can replay any of them to your local handler without re-triggering the actual GitHub action.
</Tip>

<Card title="Next: Shopify" icon="shopping-bag" href="/integrations/shopify">
  Set up Hookdrop to capture Shopify order, product, and customer events.
</Card>