Skills for Developers
The skills that let Claude integrate Subscriby into whatever you are building, from a verified webhook receiver and the right events to tokens, retries, the Zapier and n8n nodes, OpenAPI toolkits, your own agent and every MCP client.
A developer skill carries one contract the way the documentation states it, with the procedure, the traps and a generated reference of what it owns: every endpoint for the REST skill, every event with its ability and payload keys for the events skill, every error code with its remediation, every ability with its status. Claude reads the reference instead of remembering, so a tool name, a header or a code is always the current one.
custom-agents
Used when the user is building their own agent or automation on Subscriby, asks whether to use MCP or the REST API, wants an agent to register itself and get a token with the creator's confirmation, or asks how an agent should authenticate, write safely and be audited.
Rests on /integrations/custom-agents, /api/v1/agent-readiness, /mcp/v1/authentication.
errors-and-retries
Used when the user asks what a Subscriby error code means, how to handle 401, 403, 404, 409, 422 or 429 answers, which errors to retry and how, what the error envelope carries, how to surface an error to a user or an agent, or how to report a problem with a request id.
Rests on /api/v1/errors, /api/v1/rate-limiting, /reference/status-codes.
mcp-clients
Used when the user asks how to connect Subscriby to claude.ai, Claude Desktop, Cursor, ChatGPT Desktop, VS Code or another MCP client, how the OAuth handshake works, what the MCP resources are, how async tools are polled, the MCP limits, or why a client cannot connect.
Rests on /mcp/v1, /mcp/v1/quickstart, /mcp/v1/connecting-claude-desktop.
n8n
Used when the user wants to run Subscriby from n8n, install the n8n-nodes-subscriby community node on Cloud or self-hosted, configure its credential, use the Subscriby Trigger or action node, fall back to the HTTP Request and Webhook nodes, or wants workflow recipes.
Rests on /integrations/n8n.
openapi-toolkits
Used when the user wants to drive Subscriby from Make, LangChain or another OpenAPI agent toolkit, import the API into Postman or Insomnia, generate a typed client with openapi-generator, Stainless, Speakeasy or Fern, or asks what the OpenAPI document carries.
Rests on /integrations/make, /integrations/langchain, /integrations/postman-insomnia.
rest-api
Used when the user asks how to call the Subscriby REST API, what the base URL, bearer header or response envelopes look like, how to paginate, send an Idempotency-Key, honour rate limits, read the OpenAPI document, or build a client in TypeScript, PHP or Python.
Rests on /api/v1, /api/v1/quickstart, /api/v1/idempotency.
tokens-and-abilities
Used when the user asks which abilities a token needs, how to mint or scope a personal access token, what the sbt_ format is, how team and project scope work, how to rotate or revoke a token, or why a call answers TOKEN_MISSING_ABILITY or TENANT_MISMATCH.
Rests on /api/v1/authentication, /api/v1/abilities, /api/v1/tenancy-and-scopes.
webhook-events
Used when the user asks which Subscriby webhook events exist or which to subscribe to for a job, what an event's payload carries, which ability it needs, when it fires, or how to react to a new member, a failed renewal, a cancellation, a pass window or an outage.
Rests on /webhooks/v1/events.
webhooks
Used when the user asks to receive Subscriby webhooks, register or manage a webhook endpoint, verify the SB-Signature header, handle retries, dead deliveries or replays, rotate a signing secret, allow deliveries through a firewall, or debug a failing delivery.
Rests on /webhooks/v1, /webhooks/v1/quickstart, /webhooks/v1/signature-verification.
zapier
Used when the user wants to connect Subscriby to Zapier, build a Zap on a Subscriby trigger, action or search, asks which abilities the Zapier connection's token needs, why a Zap receives no events or fails test-auth, or wants Zap recipes.
Rests on /integrations/zapier.
Which skill for which job
| You are building… | Start with | Then |
|---|---|---|
| An application that sells access and must know who paid | webhooks and webhook-events | tokens-and-abilities for the subscriber token, rest-api to read the objects an event names |
| A CRM or spreadsheet sync | webhook-events | zapier or n8n when the destination has a node, webhooks when you write the receiver |
| A support assistant on the inbox | tokens-and-abilities | rest-api, errors-and-retries |
| An agent of your own | custom-agents | mcp-clients for a Claude-family model, openapi-toolkits and rest-api for any other |
| A Make scenario, a LangChain agent or a typed client | openapi-toolkits | rest-api, errors-and-retries |
| A connection from another MCP client | mcp-clients | tokens-and-abilities when the connection must be narrower than your own reach |
The verifier the webhooks skill writes
/subscriby:verify-webhook copies one of the kit's three reference verifiers into your repository in your project's conventions, with a test against a signed fixture. Each does the same four things: parse t= and v1= from SB-Signature, sign the timestamp, a dot and the raw body with HMAC-SHA256, compare in constant time, and refuse a timestamp more than 300 seconds from now, with a list of secrets so a rotation can be rolled.
import { createHmac, timingSafeEqual } from "node:crypto";
export function verifySubscribySignature(header, rawBody, secrets, tolerance = 300, now = Math.floor(Date.now() / 1000)) {
const parts = Object.fromEntries(header.split(",").map((pair) => pair.split("=").map((s) => s.trim())));
const t = Number(parts.t);
if (!Number.isInteger(t) || Math.abs(now - t) > tolerance) return false;
const signed = Buffer.concat([Buffer.from(`${t}.`), Buffer.isBuffer(rawBody) ? rawBody : Buffer.from(rawBody)]);
return [].concat(secrets).some((secret) => {
const expected = createHmac("sha256", secret).update(signed).digest();
const given = Buffer.from(parts.v1 ?? "", "hex");
return given.length === expected.length && timingSafeEqual(given, expected);
});
}Raw body, always
Every verifier signs the bytes the request carried, never a re-serialised object, because serialisers differ and the HMAC breaks on a reordered key. The skill says so, the reviewer agent checks for it, and the test's tampered case proves it.
Each skill, with the prompts that start it
Related
- Slash commands:
/subscriby:verify-webhookand/subscriby:mint-token. - Subagents: the integration reviewer reads a repository against the same contract.
- REST API, webhooks and MCP: the references the skills rest on.
How is this guide?
Last updated on
Skills for Creators
The skills that let Claude run a Subscriby community through the MCP server, from the launch to the week's figures, with the example prompts that trigger each and the point at which each one asks before it changes anything.
Skills for Connector Authors
The skills that walk Claude through building a connector on the SDK, from an empty package to a submission, with the manifest, the ports, the data rules, the fakes and the conformance kit at hand.