BACKLOG.md

Provider backlog

The wishlist of providers we'd love to support. Each is a great first contribution — run pnpm new-provider <id>, verify the scheme against the provider's official docs, fill in the config and vectors, and open a PR. See CONTRIBUTING.md.

Check the box in your PR when you ship one (the - [ ] \id`lines below feed the "Up for grabs" list in the README, regenerated bypnpm gen:table`).

⚠️ Never guess a scheme. Verify it from the provider's official documentation and link the doc in the provider README. If you cannot verify it from first-party docs, say so in the PR rather than shipping it.

Payments & billing

• paypal — webhook signature verification (transmission signature + cert chain; verify current scheme)
• square — HMAC-SHA256 over notification URL + raw body
• adyen — HMAC (HmacSignature in notification items)
• mollie — verify current scheme from docs
• razorpay — HMAC-SHA256, X-Razorpay-Signature
• coinbase-commerce — HMAC-SHA256, X-CC-Webhook-Signature
• wise — signature verification (public-key based; verify from docs)
• iyzico — verify current scheme from docs
• paytr — verify current scheme from docs
• gumroad — verify current scheme from docs
• patreon — HMAC (MD5 per docs — verify current scheme)
• whop — likely a Svix/Standard-Webhooks preset (verify)

Developer platforms

• gitlab — X-Gitlab-Token shared-secret comparison (verify)
• bitbucket — verify current scheme from docs
• linear — HMAC-SHA256, Linear-Signature
• jira — verify current scheme from docs
• sentry — HMAC-SHA256, Sentry-Hook-Signature
• vercel — HMAC-SHA1, X-Vercel-Signature
• netlify — JWS signature (verify)
• render — likely Svix/Standard-Webhooks preset (verify)
• railway — verify current scheme from docs
• supabase — likely Svix/Standard-Webhooks preset (verify)
• hasura — verify current scheme from docs

Content & data

• contentful — verify current scheme from docs
• sanity — HMAC-SHA256, sanity-webhook-signature
• strapi — verify current scheme from docs
• algolia — verify current scheme from docs
• typeform — HMAC-SHA256, base64, Typeform-Signature
• tally — verify current scheme from docs

Scheduling & comms

• cal.com — HMAC-SHA256, X-Cal-Signature-256
• calendly — HMAC-SHA256 (Webhook-Signature, t/v1 pairs — verify)
• zoom — HMAC-SHA256, x-zm-signature
• intercom — HMAC-SHA1, X-Hub-Signature
• zendesk — verify current scheme from docs

Marketing & CRM

• hubspot — v3 signature (HMAC-SHA256 over method+uri+body+timestamp — verify)
• mailgun — HMAC-SHA256 over timestamp+token
• postmark — verify current scheme from docs
• sendgrid — ECDSA signature (verify)
• loops — verify current scheme from docs
• customerio — HMAC-SHA256, X-CIO-Signature + timestamp
• brevo — verify current scheme from docs
• klaviyo — verify current scheme from docs

Auth & identity

• workos — likely Svix/Standard-Webhooks preset (verify)
• stytch — verify current scheme from docs
• kinde — verify current scheme from docs
• docusign — HMAC-SHA256, base64 (Connect signature)
• dropbox-sign — HMAC-SHA256 (verify)

Logistics

• shippo — verify current scheme from docs
• easypost — HMAC-SHA256, X-Hmac-Signature