How does this skill handle replay attacks?

It validates the 'x-vastai-timestamp' header and rejects any requests older than 5 minutes to prevent malicious actors from resubmitting old messages.

What is the benefit of idempotency in webhook handling?

Webhooks may occasionally be delivered more than once; idempotency ensures your system only processes a specific event ID a single time, preventing duplicate data entries or redundant actions.

How do I test these webhooks locally during development?

You can use a tool like ngrok to create a public URL for your local server and use the Vast.ai CLI or curl to trigger test events directly to your endpoint.

Why is signature verification necessary for Vast.ai webhooks?

It ensures that incoming requests actually originate from Vast.ai and have not been tampered with or forged by a third party.

Can I use this with frameworks other than Express.js?

Yes, while the primary examples use Express, the core cryptographic signature verification logic is written in pure TypeScript and can be adapted to any Node.js framework.

Vast.ai Webhooks & Events

Name: Vast.ai Webhooks & Events
Author: jeremylongshore

byjeremylongshore

•

1,031

API Development

Implements secure Vast.ai webhook integration with cryptographic signature validation and robust event handling.

About

This skill provides a standardized framework for integrating with Vast.ai's notification system, ensuring that your application responds reliably to resource changes. It automates the complex aspects of webhook implementation, including cryptographic signature verification using HMAC-SHA256, replay attack protection through timestamp validation, and idempotent event processing. By utilizing pre-configured patterns for Express.js and generic TypeScript handlers, developers can quickly build secure endpoints that manage GPU instance lifecycles and other critical infrastructure events without manual security configuration.

Key Features

Idempotency logic using Redis to prevent duplicate processing
1,031 GitHub stars
Testing utilities for local development using ngrok and curl
Standardized event handler patterns for resource lifecycle events
Built-in replay attack protection via timestamp validation
HMAC-SHA256 signature verification for secure authentication

Use Cases

Automating post-provisioning workflows when a GPU instance is created
Syncing local database state with real-time Vast.ai instance updates
Implementing custom billing alerts or usage monitoring based on event triggers

What are Skills?·How to Install

Install with 🐟 Skill.Fish

npx skillfish add jeremylongshore/claude-code-plugins-plus-skills vastai-webhooks-events

For use in Claude.ai and ChatGPT

Download Skill

GitHub