magnus919_agent-skills/fireflies/references/webhook-security.md

Webhook Security

Webhooks V2 events are meeting.transcribed, meeting.summarized, and meeting.bot_joined. Fireflies sends X-Hub-Signature: sha256=<hex>, an HMAC-SHA256 over the exact raw request body. Verify it before parsing or acting on the event. Use timing-safe comparison.

scripts/fireflies webhook verify --secret "$WEBHOOK_SECRET" --signature "$X_HUB_SIGNATURE" --body request-body.json --json

Use --body - to read raw bytes from stdin. This command is a local verifier, never makes a network call, and does not print the secret. A receiving endpoint should return a 2xx response within 10 seconds. Persist or queue work after verification; handle retries idempotently and avoid assuming delivery order. Test valid and invalid signatures before deployment.