Source · Linear · Verified November 1, 2026

Linear webhook source guide

Short answer: A Hooks Linear endpoint verifies Linear-Signature as hex HMAC-SHA256 over the raw body, rejects payloads whose webhookTimestamp is more than 60 seconds old, and normalizes events to issue.create, issue.update, and comment.create.

Linear webhooks are the most detail-complete issue source: team key, labels, state, and actor arrive in one payload. Hooks maps the team key to project and the label names to subject.labels, so a filter can select one team's bug issues without extra lookups.

Start for free Source to target guides

Set up the webhook in Linear

In Linear, open Settings → API → Webhooks → New webhook.
Paste the endpoint's ingestion URL and choose the resources to subscribe to (Issue, Comment).
Copy the Signing Secret into the Hooks endpoint secret.
Create an issue in a subscribed team to send the first delivery.

Signature verification

Header	`Linear-Signature: <hex>`
Algorithm	HMAC-SHA256 over the raw request body, hex encoded.
Replay window	`webhookTimestamp` (milliseconds) must be within 60 seconds of now.
Delivery id	Linear-Delivery header.

The event type comes from Linear-Event (falling back to body type) plus the body action: <resource>.<action>.
data.team.key falls back to name, and becomes project.
data.labels accepts both an array and { nodes: [...] }; names land in subject.labels.

Events Hooks normalizes

event.type	subject	What it means
`issue.create`	issue	Issue created with team, labels, state and description.
`issue.update`	issue	Issue edited or re-labeled; the current label list is included.
`issue.remove`	issue	Issue deleted.
`comment.create`	comment	Comment added to an issue or project.
`comment.update`	comment	Comment edited.
`project.create`	project	Project created.

Normalized payload

Every adapter produces this shape before filters or templates run. The raw payload and sanitized headers stay attached for audit, but filters and templates read the normalized fields.

Normalized event

{
  "id": "evt_01j9m8e6f7",
  "source": "linear",
  "type": "issue.create",
  "action": "create",
  "deliveryId": "6f1c2a9e-4b7d-4c3a-9a1e-2d5f8b0c7e13",
  "occurredAt": "2026-11-01T09:21:57.000Z",
  "actor": { "login": "octocat", "id": "a1b2c3d4", "type": "user" },
  "project": "APP",
  "subject": {
    "kind": "issue",
    "id": "APP-7",
    "title": "Login fails on Safari",
    "url": "https://linear.app/acme/issue/APP-7",
    "body": "Signing in on Safari 18 returns a 500 after the redirect.",
    "labels": ["bug", "agent"],
    "state": "Todo"
  }
}

Filter and template examples

Filter: new issues for one team

{
  "allow": [
    { "field": "event.type", "op": "equals", "value": "issue.create" },
    { "field": "event.project", "op": "equals", "value": "APP" }
  ]
}

Destination: T3 Code task

{
  "url": "{{secret.T3CODE_WEBHOOK_URL}}",
  "signature": {
    "secret": "{{secret.T3CODE_SIGNING_SECRET}}",
    "header": "x-hub-signature-256",
    "encoding": "hex",
    "prefix": "sha256="
  },
  "body": {
    "title": "{{event.subject.title}}",
    "url": "{{event.subject.url}}",
    "repo": "{{event.project}}"
  }
}

Retries and the delivery log

408, 425, 429, and 5xx responses retry with backoff and honor Retry-After; other 4xx responses fail permanently with a named code. Every attempt keeps the rendered request and the target response, so a failure points at one field or one status instead of a guess.

Hooks delivery detail: attempt timeline, request payload, and the destination response for one delivery — Delivery detail: the attempt timeline, the rendered request the target received, and its response — the same record an event keeps for every destination.

Common errors

Symptom	Fix
`SIGNATURE_INVALID`	The endpoint secret must equal the webhook's Signing Secret exactly. Re-copy it from Linear; it is shown only on creation unless rotated.
`Stale payload rejected`	Linear's `webhookTimestamp` must be within 60 seconds. Check the machine clock of anything that replays captured requests, and prefer test events.
Filter on `bug` never matches	Labels live on `event.subject.labels` as names, not ids. Use `contains` for a single label and `in` for a multi-label condition.

Pair with a target

Linear to T3 CodeStart a T3 Code task when a Linear issue is created: issue.create filter, team and label fields, signed request body, and the delivered run explained.Linear to Grok BotRoute Linear bug issues to Grok Bot triage: the singular issue.create type, label filters, team mapping, and what happens when a task renders empty.All source to target guidesEvery combination built from this source, with filters and target configs.

Reference

Receiving eventshttps://hooks.events/docs/receive-events.md
Verify signatureshttps://hooks.events/docs/signatures.md
Payload templateshttps://hooks.events/docs/templates.md

Other sources

GitHubA Hooks GitHub endpoint verifies the X-Hub-Signature-256 HMAC on the raw body, stores the delivery, and normalizes each webhook into <event>.<action> (for example issues.opened) before any destination filter runs.StripeA Hooks Stripe endpoint verifies Stripe-Signature as HMAC-SHA256 over <timestamp>.<raw body> with a five-minute tolerance, then normalizes each event to <resource>.<action> such as invoice.payment_failed.SlackA Hooks Slack endpoint verifies X-Slack-Signature as HMAC-SHA256 over v0:<timestamp>:<raw body>, answers the url_verification handshake itself, and normalizes messages to app_mention.received or message.<channel_type>.SentryA Hooks Sentry endpoint verifies Sentry-Hook-Signature as hex HMAC-SHA256 with the Integration's Client Secret, deduplicates by Request-ID, and normalizes events to issue.created or event_alert.triggered.GitLabGitLab project webhooks cover pushes, merge requests, pipelines, issues, notes, and releases.ShopifyShopify app webhooks send topic-scoped events such as orders/create, products/update, and refunds/create.IntercomIntercom sends conversation and contact notification topics, signed with the app client secret.ZendeskZendesk webhooks cover ticket, user, and organization events, signed with a timestamp plus body HMAC.JiraJira Cloud webhooks cover issue creation, updates, comments, and sprint changes.PagerDutyPagerDuty v3 webhooks cover incident trigger, acknowledge, resolve, and annotation events.Standard WebhooksStandard Webhooks deliveries carry webhook-id, webhook-timestamp, and base64 v1 signatures.SvixSvix Play and the Svix dispatcher use the Standard Webhooks headers with svix- prefixes.VercelVercel webhooks cover deployment, integration, project, and domain events.TwilioTwilio status callbacks cover messages, calls, and recordings, signed over the URL and form parameters.DiscordDiscord interaction webhooks use Ed25519 signatures plus a PING handshake.Generic HMACGeneric sources sign timestamp.deliveryId.body with HMAC-SHA256 and send the signature in x-signature.BitbucketBitbucket Cloud repository webhooks cover pushes, pull request changes, and issue events.