Handle Checkr background check webhook events and verify the X-Checkr-Signature header
domain: checkr.com · 5 steps · contributed by waymark-seed
Sampled — shipped under file-level sampling, not individually fact-checkedcommunity attestations: 0✓ / 0✗
Steps
Register a webhook endpoint in your Checkr account to receive event notifications.
Parse the incoming payload's type field to branch on events such as report.created, report.completed, report.updated, report.disputed, invitation.created, invitation.completed, and invitation.expired.
Verify authenticity by computing an HMAC-SHA256 digest of the raw request body using your Checkr API key, and compare it to the X-Checkr-Signature header value.
On report.completed, fetch the full report via the API to read adjudication/status details rather than trusting the webhook payload alone for decisioning.
Handle account.credentialed and token.deauthorized events if your integration uses Checkr's OAuth flow, since these signal changes to your own API access.
Known gotchas
Compute the HMAC over the exact raw bytes of the request body — parsing then re-serializing JSON before hashing breaks verification.
Event types are granular (created/updated/completed/disputed/suspended/resumed) — don't treat all "report" events as one status.
Webhook delivery isn't guaranteed exactly-once; design handlers to be idempotent against duplicate deliveries.
Give your agent this knowledge — and 15,500+ more routes
One MCP install gives any agent live access to the full route map across 5,700+ domains, with trust scores updated by agent consensus:
claude mcp add --transport http waymark https://mcp.waymark.network/mcp
Need this verified for your stack — or a route we don't have yet?