> ## Documentation Index > Fetch the complete documentation index at: https://docs.extend.ai/llms.txt > Use this file to discover all available pages before exploring further. > > ## API version > The current API version is `2026-02-09`, served at the site root (no version prefix in URLs). > If this page URL contains `/2025-04-21/` or `/2024-12-23/`, you are reading an older API version. > Prefer the current docs at https://docs.extend.ai/llms.txt unless the user explicitly needs that older version. > Do not treat older-version pages as the source of truth for new integrations. # Webhook Configuration > Set up webhook endpoints, subscribe to events, and verify deliveries Webhooks push events to your server as work completes, so you don't have to poll for results. You can configure them in the dashboard or with the API — both use the same two building blocks described below. ## How webhooks work Two concepts work together: * **Endpoint** — a destination URL that receives events, along with a signing secret used to verify them. Each endpoint is pinned to a single API version. * **Subscription** — what an endpoint listens for. There are two kinds, and an endpoint can use both at once: * **Global events** are set directly on the endpoint (its `enabledEvents`). They fire for every resource of that type in the workspace, plus workspace-level lifecycle events like `extractor.created` and `workflow.deployed`. * **Resource-scoped subscriptions** bind an endpoint to a single resource — one extractor, classifier, splitter, or workflow — so you only receive that resource's events. | | Global events | Resource-scoped subscriptions | | ----------------- | -------------------------------------------------------------- | -------------------------------------------------- | | Scope | Every resource of a type in the workspace | One specific resource | | Configured on | The endpoint (`enabledEvents`) | A subscription attached to the endpoint | | Reach for it when | You want all extract runs, all parse runs, or lifecycle events | You only care about a single workflow or extractor | Run events are only delivered for runs created through the API — runs started from the dashboard do not trigger webhooks. Some events are only available as resource-scoped subscriptions. `workflow_run.*` events (for example `workflow_run.completed`) and other per-run workflow events are delivered through workflow subscriptions, not global events. Run-completion events like `extract_run.processed` are available at both levels — globally for all extractors, or scoped to a single extractor. ## Set up a webhook in the dashboard To set up a webhook, create one in the "Developers" tab on the sidebar, under the "Webhook endpoints" section. ![Webhooks settings page with the create endpoint button](https://fdr-prod-docs-files-public.s3.us-east-1.amazonaws.com/extendconfig.docs.buildwithfern.com/c2fe20b4d5b5d4c40548807278d3efb9fb22ec0501e2c20acf1e9cd1d769619f/assets/images/webhooks/create_webhook_endpoint.png?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Content-Sha256=UNSIGNED-PAYLOAD&X-Amz-Credential=AKIA6KXJSKKNFOCF7G4B%2F20260903%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20260903T160751Z&X-Amz-Expires=604800&X-Amz-Signature=c8d3e0b323f636f9b76497b895dd03e47893ce7087851538cbcc10558eade0c1&X-Amz-SignedHeaders=host&x-amz-checksum-mode=ENABLED&x-id=GetObject) ### Subscribe to global events When creating a webhook endpoint, you can subscribe to the `GLOBAL` event types. These events are not associated with a specific workflow or processor and are global to your workspace. ![Modal for creating a new webhook endpoint](https://fdr-prod-docs-files-public.s3.us-east-1.amazonaws.com/extendconfig.docs.buildwithfern.com/1472f24bfc43b0cfb9d5ed5a4c90aebd5a1d88e73859afd11a0acf6387579602/assets/images/webhooks/create_webhook_endpoint_modal.png?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Content-Sha256=UNSIGNED-PAYLOAD&X-Amz-Credential=AKIA6KXJSKKNFOCF7G4B%2F20260903%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20260903T160751Z&X-Amz-Expires=604800&X-Amz-Signature=18182fbc2c9cb3cd57d23a80ea425fb3185729fca29efda8d945dccf61a6c433&X-Amz-SignedHeaders=host&x-amz-checksum-mode=ENABLED&x-id=GetObject) See the [Events](/webhooks/events) section for more details on the different event types you can subscribe to. ### Workflow-specific subscriptions After you have created one or more webhook endpoints from the "Developer" tab, you can subscribe to events for specific workflows by navigating to the desired workflow(s) and opening the "Webhook Subscriptions" menu. ![Selecting webhook settings in the dashboard](https://fdr-prod-docs-files-public.s3.us-east-1.amazonaws.com/extendconfig.docs.buildwithfern.com/bb0ebb4412cc3153e58b97b7cc9bd6db470c6ffc6087e7d8e8544a8e348fe60c/assets/images/webhooks/select_webhook_settings.png?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Content-Sha256=UNSIGNED-PAYLOAD&X-Amz-Credential=AKIA6KXJSKKNFOCF7G4B%2F20260903%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20260903T160751Z&X-Amz-Expires=604800&X-Amz-Signature=7567837fc5c8f45217ee001ac5847c072cbcc0f1356614826d19d2762a4532c6&X-Amz-SignedHeaders=host&x-amz-checksum-mode=ENABLED&x-id=GetObject) Then you can create new subscriptions for the desired endpoints and event types. ![Create subscription button on the webhook endpoint page](https://fdr-prod-docs-files-public.s3.us-east-1.amazonaws.com/extendconfig.docs.buildwithfern.com/b29fee9c87d4ae3fd46bd62082d46e83794f536acacd2c742d4ef3cd80517c28/assets/images/webhooks/create_subscription_btn.png?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Content-Sha256=UNSIGNED-PAYLOAD&X-Amz-Credential=AKIA6KXJSKKNFOCF7G4B%2F20260903%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20260903T160751Z&X-Amz-Expires=604800&X-Amz-Signature=a536bc73bbbeb7a3592841fd0705f62a577e86a5730cdcb623f1602d9e65e32a&X-Amz-SignedHeaders=host&x-amz-checksum-mode=ENABLED&x-id=GetObject) ![Modal for creating a webhook subscription](https://fdr-prod-docs-files-public.s3.us-east-1.amazonaws.com/extendconfig.docs.buildwithfern.com/18d07c7f71fc0dcb8bd76101db0eb38032d4805a977a6836e66b9025eca728a9/assets/images/webhooks/create_subscription.png?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Content-Sha256=UNSIGNED-PAYLOAD&X-Amz-Credential=AKIA6KXJSKKNFOCF7G4B%2F20260903%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20260903T160751Z&X-Amz-Expires=604800&X-Amz-Signature=6d8daaae3b80f272c72a17b6acba213a9f4a8b0a11b6610811edf64a5a41974d&X-Amz-SignedHeaders=host&x-amz-checksum-mode=ENABLED&x-id=GetObject) Once subscribed, you will start to receive events to the specified webhook endpoint based on the selected event types each time you run a file(s) through that workflow. See the [Events](/webhooks/events) section for more details on the different event types you can subscribe to and the shape of the payload for each event type. ### Processor run-specific subscriptions You can also subscribe to events for specific processor runs. This is necessary if you are running processors directly and not via a workflow. To start, navigate to the "Overview" tab of the given processor in Studio, click "Webhook Subscriptions", and then click the "Add webhook subscription" button. ![Adding a webhook subscription from a processor page](https://fdr-prod-docs-files-public.s3.us-east-1.amazonaws.com/extendconfig.docs.buildwithfern.com/75b03299e995ec22c44846bf19d5c747c9db0ee0196e6f06da8aaa380a74c14a/assets/images/webhooks/processor_add_webhook_subscription.png?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Content-Sha256=UNSIGNED-PAYLOAD&X-Amz-Credential=AKIA6KXJSKKNFOCF7G4B%2F20260903%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20260903T160751Z&X-Amz-Expires=604800&X-Amz-Signature=002f2a187fdf71f659ac12e5b60bf5a2d925eadf09ce01833a1cb4f7a3513ae1&X-Amz-SignedHeaders=host&x-amz-checksum-mode=ENABLED&x-id=GetObject) Next, you can select the desired event types you would like to subscribe to and assign the webhook endpoint you would like to receive events at. ![Modal for subscribing a processor to webhook events](https://fdr-prod-docs-files-public.s3.us-east-1.amazonaws.com/extendconfig.docs.buildwithfern.com/07db1be7856fdd921ee10f3a41c6e36b899b8188800d5ba049cd19bb08727cfb/assets/images/webhooks/processor_add_webhook_subscription_modal.png?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Content-Sha256=UNSIGNED-PAYLOAD&X-Amz-Credential=AKIA6KXJSKKNFOCF7G4B%2F20260903%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20260903T160751Z&X-Amz-Expires=604800&X-Amz-Signature=64e9afd4e0ac3902e770ea357a5e2a6fe7476b6aacdcfcc10a8ff23bbceb5f46&X-Amz-SignedHeaders=host&x-amz-checksum-mode=ENABLED&x-id=GetObject) ### Webhook delivery format We support two delivery formats for webhooks: * **JSON**: This is the default and most common format. It is a simple JSON object with the event data in the body. * **Signed Download URL**: This is a signed URL that allows you to download the event data as a file. This is useful for scenarios where the webhook event payload is too large to fit in the body of the request, or you have payload size constraints on your webhook endpoint. We also provide the option to send all payloads as a signed download URL over a certain size threshold, which can be configured in bytes when creating/updating a webhook endpoint. The signed download URL has a one hour expiration time. When manually re-trying a webhook request, a new URL will be generated each time, and when viewing the webhook history for events sent as a URL, a new URL is generated for viewing. To configure the delivery format, you can select the desired format in the "Advanced options" dropdown when creating/updating a webhook endpoint. ![Webhook settings for including file download URLs in payloads](https://fdr-prod-docs-files-public.s3.us-east-1.amazonaws.com/extendconfig.docs.buildwithfern.com/7ea69d8778b47bd43bff646bd131f22672c429767b64aaa7d6d0afd88c23f163/assets/images/webhooks/webhook_download_url_settings.png?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Content-Sha256=UNSIGNED-PAYLOAD&X-Amz-Credential=AKIA6KXJSKKNFOCF7G4B%2F20260903%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20260903T160751Z&X-Amz-Expires=604800&X-Amz-Signature=c5b22339c860513f7ca303b12055410ff661be92d957bc8ad7dd745514f078a3&X-Amz-SignedHeaders=host&x-amz-checksum-mode=ENABLED&x-id=GetObject) ## Configure webhooks with the API Everything you can do in the dashboard you can also do programmatically. This is the path to reach for when you provision webhooks per customer or environment, manage them in infrastructure-as-code, or let an agent wire up its own event delivery. ### Create an endpoint Creating an endpoint registers a URL and sets its global `enabledEvents`. The response includes a `signingSecret` — **it is returned only once**, so store it securely. You'll need it to [verify deliveries](#verifying-webhook-requests). ```bash cURL curl -X POST https://api.extend.ai/webhook_endpoints \ -H "Authorization: Bearer YOUR_API_KEY" \ -H "x-extend-api-version: 2026-02-09" \ -H "Content-Type: application/json" \ -d '{ "url": "https://example.com/webhooks", "name": "Production webhook", "enabledEvents": ["extract_run.processed", "extract_run.failed"], "apiVersion": "2026-02-09" }' ``` ```python Python from extend_ai import Extend client = Extend(token="YOUR_API_KEY") endpoint = client.webhook_endpoints.create( url="https://example.com/webhooks", name="Production webhook", enabled_events=["extract_run.processed", "extract_run.failed"], api_version="2026-02-09", ) # Returned only once — store it securely. print(endpoint.signing_secret) ``` ```typescript TypeScript import { ExtendClient } from "extend-ai"; const client = new ExtendClient({ token: "YOUR_API_KEY" }); const endpoint = await client.webhookEndpoints.create({ url: "https://example.com/webhooks", name: "Production webhook", enabledEvents: ["extract_run.processed", "extract_run.failed"], apiVersion: "2026-02-09", }); // Returned only once — store it securely. console.log(endpoint.signingSecret); ``` ```java Java import ai.extend.ExtendClient; import ai.extend.resources.webhookendpoints.requests.WebhookEndpointsCreateRequest; import ai.extend.types.WebhookEndpointCreate; import ai.extend.types.WebhookEndpointEventType; import java.util.List; ExtendClient client = ExtendClient.builder().apiKey("YOUR_API_KEY").build(); WebhookEndpointCreate endpoint = client.webhookEndpoints().create( WebhookEndpointsCreateRequest.builder() .url("https://example.com/webhooks") .name("Production webhook") .apiVersion("2026-02-09") .enabledEvents(List.of( WebhookEndpointEventType.EXTRACT_RUN_PROCESSED, WebhookEndpointEventType.EXTRACT_RUN_FAILED)) .build()); // Returned only once — store it securely. System.out.println(endpoint.getSigningSecret()); ``` ```go Go import ( "context" extend "github.com/extend-hq/extend-go-sdk" client "github.com/extend-hq/extend-go-sdk/client" option "github.com/extend-hq/extend-go-sdk/option" ) c := client.NewClient(option.WithToken("YOUR_API_KEY")) endpoint, err := c.WebhookEndpoints.Create(context.Background(), &extend.WebhookEndpointsCreateRequest{ URL: "https://example.com/webhooks", Name: "Production webhook", EnabledEvents: []extend.WebhookEndpointEventType{ extend.WebhookEndpointEventTypeExtractRunProcessed, extend.WebhookEndpointEventTypeExtractRunFailed, }, APIVersion: "2026-02-09", }) // endpoint.SigningSecret is returned only once — store it securely. ``` Pass an empty `enabledEvents` array to create an endpoint with no global events — useful when you only plan to route specific resources to it via subscriptions. ### Subscribe to a specific resource To receive events for a single resource, create a subscription against an existing endpoint. Set the `resourceType` (`extractor`, `classifier`, `splitter`, or `workflow`), the `resourceId`, and the `enabledEvents` that are valid for that resource type. If a subscription already exists for the same endpoint and resource, it is updated rather than duplicated. ```bash cURL curl -X POST https://api.extend.ai/webhook_subscriptions \ -H "Authorization: Bearer YOUR_API_KEY" \ -H "x-extend-api-version: 2026-02-09" \ -H "Content-Type: application/json" \ -d '{ "webhookEndpointId": "wh_Xj8mK2pL9nR4vT7qY5wZ", "resourceType": "workflow", "resourceId": "workflow_id_here", "enabledEvents": ["workflow_run.completed", "workflow_run.failed"] }' ``` ```python Python subscription = client.webhook_subscriptions.create( webhook_endpoint_id="wh_Xj8mK2pL9nR4vT7qY5wZ", resource_type="workflow", resource_id="workflow_id_here", enabled_events=["workflow_run.completed", "workflow_run.failed"], ) ``` ```typescript TypeScript const subscription = await client.webhookSubscriptions.create({ webhookEndpointId: "wh_Xj8mK2pL9nR4vT7qY5wZ", resourceType: "workflow", resourceId: "workflow_id_here", enabledEvents: ["workflow_run.completed", "workflow_run.failed"], }); ``` ```java Java import ai.extend.resources.webhooksubscriptions.requests.WebhookSubscriptionsCreateRequest; import ai.extend.types.WebhookSubscription; import ai.extend.types.WebhookSubscriptionEventType; import ai.extend.types.WebhookSubscriptionResourceType; import java.util.List; WebhookSubscription subscription = client.webhookSubscriptions().create( WebhookSubscriptionsCreateRequest.builder() .webhookEndpointId("wh_Xj8mK2pL9nR4vT7qY5wZ") .resourceType(WebhookSubscriptionResourceType.WORKFLOW) .resourceId("workflow_id_here") .enabledEvents(List.of( WebhookSubscriptionEventType.WORKFLOW_RUN_COMPLETED, WebhookSubscriptionEventType.WORKFLOW_RUN_FAILED)) .build()); ``` ```go Go subscription, err := c.WebhookSubscriptions.Create(context.Background(), &extend.WebhookSubscriptionsCreateRequest{ WebhookEndpointID: "wh_Xj8mK2pL9nR4vT7qY5wZ", ResourceType: extend.WebhookSubscriptionResourceTypeWorkflow, ResourceID: "workflow_id_here", EnabledEvents: []extend.WebhookSubscriptionEventType{ extend.WebhookSubscriptionEventTypeWorkflowRunCompleted, extend.WebhookSubscriptionEventTypeWorkflowRunFailed, }, }) ``` The valid `enabledEvents` for a subscription depend on its `resourceType`: | Resource type | Available events | | ------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | `extractor` | `extract_run.processed`, `extract_run.failed`, `batch_processor_run.processed`, `batch_processor_run.failed` | | `classifier` | `classify_run.processed`, `classify_run.failed`, `batch_processor_run.processed`, `batch_processor_run.failed` | | `splitter` | `split_run.processed`, `split_run.failed`, `batch_processor_run.processed`, `batch_processor_run.failed` | | `workflow` | `workflow_run.completed`, `workflow_run.failed`, `workflow_run.needs_review`, `workflow_run.rejected`, `workflow_run.cancelled`, `workflow_run.step_run.processed` | ### Manage endpoints and subscriptions Both resources support the full set of list, retrieve, update, and delete operations. A few things to know: * **Updates are partial** — only the fields you send are changed. An endpoint's `apiVersion` cannot be changed after creation. * **Deleting an endpoint** also deletes all of its subscriptions, and is permanent. * **Filtering** — list subscriptions by `webhookEndpointId` to see everything an endpoint listens for, or by `resourceId` to see every endpoint a resource notifies. See the API reference for the full schemas and every operation: [Create Webhook Endpoint](/2026-02-09/api-reference/endpoints/webhook/create-webhook-endpoint) and [Create Webhook Subscription](/2026-02-09/api-reference/endpoints/webhook/create-webhook-subscription). Prefer the command line? The [Extend CLI](/cli) wraps these endpoints with `extend webhooks endpoints`, `extend webhooks subscriptions`, and `extend webhooks verify`. ## Verifying webhook requests Extend will sign each webhook request using a secret unique to the webhook. You can use this signature along with the timestamp to verify that the request is coming from Extend as well as protect against replay attacks. ### Using the SDK (Recommended) The easiest way to verify webhook requests is using the SDK's built-in helper methods. These handle signature verification, timestamp validation, and event parsing automatically. ```python Python SDK from extend_ai import Extend from extend_ai.wrapper.errors import WebhookSignatureVerificationError client = Extend(token="YOUR_API_KEY") @app.post("/webhook") def handle_webhook(request): try: # verify_and_parse validates the signature and parses the event in one step event = client.webhooks.verify_and_parse( body=request.body.decode(), # Raw request body as string headers=dict(request.headers), # Request headers as dict signing_secret="wss_your_signing_secret" # Your webhook signing secret ) # Handle the event based on type if event["eventType"] == "workflow_run.completed": print("Workflow completed:", event["payload"]) elif event["eventType"] == "extract_run.processed": print("Extract run processed:", event["payload"]) # ... handle other event types return {"status": "ok"} except WebhookSignatureVerificationError: return {"error": "Invalid signature"}, 401 ``` ```typescript TypeScript SDK import { ExtendClient } from "extend-ai"; const client = new ExtendClient({ token: "YOUR_API_KEY" }); app.post("/webhook", (req, res) => { try { // verifyAndParse validates the signature and parses the event in one step const event = client.webhooks.verifyAndParse( req.body.toString(), // Raw request body as string req.headers, // Request headers "wss_your_signing_secret" // Your webhook signing secret ); // Handle the event based on type switch (event.eventType) { case "workflow_run.completed": console.log("Workflow completed:", event.payload); break; case "extract_run.processed": console.log("Extract run processed:", event.payload); break; // ... handle other event types } res.status(200).send("OK"); } catch (err) { if (err.name === "WebhookSignatureVerificationError") { res.status(401).send("Invalid signature"); } else { res.status(500).send("Internal error"); } } }); ``` ```java Java SDK import ai.extend.ExtendClient; import ai.extend.types.WebhookEvent; import ai.extend.wrapper.errors.WebhookSignatureVerificationError; import java.util.Map; ExtendClient client = ExtendClient.builder().apiKey("YOUR_API_KEY").build(); // Inside your webhook handler: try { // verifyAndParse validates the signature and parses the event in one step WebhookEvent event = client.webhooks().verifyAndParse( requestBody, // Raw request body as a string requestHeaders, // Map of request headers "wss_your_signing_secret" // Your webhook signing secret ); // event is a typed union — dispatch on the specific event type with // event.visit(new WebhookEvent.Visitor<>() { ... }) to handle // workflowRunCompleted, extractRunProcessed, and the other event types. handleEvent(event); // Respond 200 OK } catch (WebhookSignatureVerificationError e) { // Respond 401 — invalid signature } ``` The Go SDK does not include a webhook verification helper. Go users should verify the signature manually — see [Manual Verification](#manual-verification) below. The signing secret can be found in the webhooks table under the "Developer" tab: ![Webhook signing secret shown in endpoint settings](https://fdr-prod-docs-files-public.s3.us-east-1.amazonaws.com/extendconfig.docs.buildwithfern.com/064501a29139db042683d8850104121ce062f531cd63c42af6d94558abc2bfad/assets/images/webhooks/webhooks_secret.png?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Content-Sha256=UNSIGNED-PAYLOAD&X-Amz-Credential=AKIA6KXJSKKNFOCF7G4B%2F20260903%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20260903T160751Z&X-Amz-Expires=604800&X-Amz-Signature=abf6ba36d6b681fa024bc1ee75ea789104860c10271f1a2337ff97ea6e66e3a6&X-Amz-SignedHeaders=host&x-amz-checksum-mode=ENABLED&x-id=GetObject) ### Handling Signed URL Payloads For large payloads, webhooks may be delivered via a signed URL instead of inline. To handle these: ```python Python SDK event = client.webhooks.verify_and_parse(body, headers, secret, allow_signed_url=True) if client.webhooks.is_signed_url_event(event): # Fetch the full payload from the signed URL full_event = await client.webhooks.fetch_signed_payload(event) print("Full payload:", full_event["payload"]) else: # Normal inline payload print("Payload:", event["payload"]) ``` ```typescript TypeScript SDK const event = client.webhooks.verifyAndParse(body, headers, secret, { allowSignedUrl: true }); if (client.webhooks.isSignedUrlEvent(event)) { // Fetch the full payload from the signed URL const fullEvent = await client.webhooks.fetchSignedPayload(event); console.log("Full payload:", fullEvent.payload); } else { // Normal inline payload console.log("Payload:", event.payload); } ``` ```java Java SDK import ai.extend.wrapper.webhooks.RawWebhookEvent; import ai.extend.wrapper.webhooks.VerifyAndParseOptions; import ai.extend.types.WebhookEvent; RawWebhookEvent raw = client.webhooks().verifyAndParseWithOptions( body, headers, secret, VerifyAndParseOptions.builder().allowSignedUrl(true).build() ); if (raw.isSignedUrlEvent()) { // Fetch the full payload from the signed URL WebhookEvent fullEvent = client.webhooks().fetchSignedPayload(raw.getSignedUrlEvent()); System.out.println("Full payload: " + fullEvent); } else { // Normal inline payload WebhookEvent event = raw.getEvent(); System.out.println("Payload: " + event); } ``` ### Manual Verification If you're not using the SDK, you can verify webhook signatures manually: 1. Retrieve the timestamp of the request from `x-extend-request-timestamp`, the body of the request, and the signing secret associated with the webhook. 2. Concatenate the timestamp and request body using the following format: `v0:${timestamp}:${requestBody}` 3. Compute an HMAC-SHA-256 digest on the resulting string using the signing secret as the key. 4. Compare this digest with the signature provided in `x-extend-request-signature`. If they are equal, then the request is verified to be from Extend. ```python Python import hmac import hashlib import time timestamp = request.headers.get('x-extend-request-timestamp') received_signature = request.headers.get('x-extend-request-signature') signing_secret = "wss_your_signing_secret" # Validate timestamp to prevent replay attacks current_time = int(time.time()) if current_time - int(timestamp) > 300: # 5 minutes raise ValueError('Request timestamp too old') request_body_string = request.body.decode() message = f"v0:{timestamp}:{request_body_string}" expected_signature = hmac.new( signing_secret.encode('utf-8'), message.encode('utf-8'), hashlib.sha256 ).hexdigest() if not hmac.compare_digest(expected_signature, received_signature): raise ValueError('Invalid webhook signature') # Proceed with webhook processing ``` ```typescript TypeScript import crypto from "crypto"; const timestamp = request.headers['x-extend-request-timestamp']; const receivedSignature = request.headers['x-extend-request-signature']; const signingSecret = "wss_your_signing_secret"; // Validate timestamp to prevent replay attacks const currentTime = Math.floor(Date.now() / 1000); if (currentTime - parseInt(timestamp) > 300) { // 5 minutes throw new Error('Request timestamp too old'); } // Use the EXACT raw request body that Extend signed — not a re-serialized copy. // Re-serializing (e.g. JSON.stringify(request.body)) can reorder keys or change // whitespace and cause valid signatures to fail. In Express, capture the raw body // on the webhook route with `express.raw({ type: '*/*' })`. const requestBodyString = request.body.toString(); const message = `v0:${timestamp}:${requestBodyString}`; const expectedSignature = crypto .createHmac("sha256", signingSecret) .update(message) .digest("hex"); // Constant-time comparison to avoid leaking timing information const expectedBuffer = Buffer.from(expectedSignature); const receivedBuffer = Buffer.from(receivedSignature ?? ""); if ( expectedBuffer.length !== receivedBuffer.length || !crypto.timingSafeEqual(expectedBuffer, receivedBuffer) ) { throw new Error('Invalid webhook signature'); } // Proceed with webhook processing ``` ```go Go import ( "crypto/hmac" "crypto/sha256" "encoding/hex" "fmt" "strconv" "time" ) timestamp := headers.Get("x-extend-request-timestamp") receivedSignature := headers.Get("x-extend-request-signature") signingSecret := "wss_your_signing_secret" // Validate timestamp to prevent replay attacks ts, err := strconv.ParseInt(timestamp, 10, 64) if err != nil || time.Now().Unix()-ts > 300 { // 5 minutes return fmt.Errorf("request timestamp too old or invalid") } // Use the exact raw request body that Extend signed — not a re-serialized copy message := fmt.Sprintf("v0:%s:%s", timestamp, string(requestBody)) mac := hmac.New(sha256.New, []byte(signingSecret)) mac.Write([]byte(message)) expectedSignature := hex.EncodeToString(mac.Sum(nil)) // Constant-time comparison to avoid leaking timing information if !hmac.Equal([]byte(expectedSignature), []byte(receivedSignature)) { return fmt.Errorf("invalid webhook signature") } // Proceed with webhook processing ```