Webhooks

Events

Webhook Headers

Webhook Handler Checklist

1. Verify signature before trusting payload.
2. Reject old timestamps to prevent replay attacks.
3. Handle duplicates idempotently.
4. Ack quickly and offload heavy work to queue.

Signature Verification (Node.js)

import crypto from 'node:crypto';

export function verifyWebhook(rawBody, timestamp, signature, secret) {
  const signed = `${timestamp}.${rawBody}`;
  const digest = crypto.createHmac('sha256', secret).update(signed).digest('hex');
  const expected = `sha256=${digest}`;
  return crypto.timingSafeEqual(Buffer.from(expected), Buffer.from(signature || ''));
}

Quality Guardrails

• Prefer representative source clips when tuning model defaults.
• Keep input compression moderate to preserve edge details.
• Use explicit output format policy for transparent vs non-transparent workflows.
• Run A/B validation with the same clip set before changing defaults.

Implementation Checklist

1. Define payload schema validation in backend before forwarding requests.
2. Store model/output_format/background settings with each job record.
3. Add internal quality review for difficult scenes (hair, glass, motion blur).
4. Create runbook entries for model-specific failure cases.

Webhook Security Hardening

• Validate signature and timestamp on every callback.
• Reject duplicate event ids unless explicitly idempotent.
• Store raw payload and signature for forensics and reprocessing.