mirror of
https://github.com/magnus919/agent-skills.git
synced 2026-09-16 05:56:30 +03:00
15 lines
790 B
Markdown
15 lines
790 B
Markdown
# Webhook Security
|
|
|
|
Webhooks V2 events are `meeting.transcribed`, `meeting.summarized`, and `meeting.bot_joined`.
|
|
Fireflies sends `X-Hub-Signature: sha256=<hex>`, an HMAC-SHA256 over the exact raw request body.
|
|
Verify it before parsing or acting on the event. Use timing-safe comparison.
|
|
|
|
```bash
|
|
scripts/fireflies webhook verify --secret "$WEBHOOK_SECRET" --signature "$X_HUB_SIGNATURE" --body request-body.json --json
|
|
```
|
|
|
|
Use `--body -` to read raw bytes from stdin. This command is a local verifier, never makes a
|
|
network call, and does not print the secret. A receiving endpoint should return a 2xx response
|
|
within 10 seconds. Persist or queue work after verification; handle retries idempotently and avoid
|
|
assuming delivery order. Test valid and invalid signatures before deployment.
|