Handle webhooks

View as Markdown ✓ Tested with v3.0.0 · 2026-10-23

AIKloop sends events to your endpoint. Each request has a AIKloop-Signature header, for example t=1791830400,v1=<hex digest>. To verify it:

1. Take t (a Unix timestamp) and the raw request body.
2. Compute HMAC-SHA256 of "{t}.{raw_body}" with your webhook signing secret (whsec_...).
3. Compare the result with v1 using a constant-time comparison.
4. Reject the event if t is more than 5 minutes old, to block replays.