Webhooks

VideoSDK signs the webhooks it delivers to your endpoints. Use webhooks.verify to check the signature and parse the event before you trust it.

Verify a webhook

Pass the raw, unparsed request body and the videosdk-signature header. Verification is RSA-SHA256, and the signing public key is fetched and cached for you. A missing or invalid signature raises a webhook verification error.

Node.js

// The body must stay raw, so register the route with a raw body parser.
app.post("/webhooks/videosdk", express.raw({ type: "*/*" }), async (req, res) => {
  const event = await client.webhooks.verify(req.body, req.headers["videosdk-signature"]);
  if (event.type === "recording-stopped") {
    // handle event.data
  }
  res.sendStatus(200);
});

Go

event, err := client.Webhooks.Verify(ctx, rawBody, r.Header.Get("videosdk-signature"))
if err != nil {
	// signature missing or invalid
	return
}
if event.Type == "recording-stopped" {
	// unmarshal event.Data
}

Rust

// Webhook verification is not yet available in the Rust server SDK.
// Verify the RSA-SHA256 `videosdk-signature` header manually, or use the
// Node.js or Go SDK for built-in verification.

To skip the network fetch, pin the RSA public key with the webhookPublicKey option (see Configuration). Node also accepts { publicKey } as a third argument, and Go exposes VerifySync(rawBody, signature, publicKey) for a key you already hold.

The webhook event

Field	Type	Description
type	string	Event type, such as recording-stopped.
data	object	Event payload. In Go this is the raw JSON bytes to unmarshal into the shape for the type.
raw	bytes	The full raw JSON body (Go only).