Guides
Get a signed webhook on every event
Register an endpoint, verify the signature and timestamp on every call, choose your events, and handle retries and the dead-letter state.
On this page
AI Assistant can call your own system on every event that matters — a conversation starts, a message arrives, a visitor asks for a person, an identity is verified, a tool runs. Each call is a signed HTTPS POST you verify and act on however you like. This guide sets one up end to end.
1. Register an endpoint
In Console → Connections, open Webhooks and add an endpoint. Give it a public https:// address that your server controls, pick the events you want, and save. The platform generates a signing secret and shows it once — copy it now and store it where your server reads its secrets. You will not see it again; if you lose it, rotate the endpoint for a new one.
2. Verify every call
Each delivery carries three headers: X-Busymate-Timestamp (unix seconds), X-Busymate-Signature (t=<timestamp>,v1=<hex>), and X-Busymate-Delivery (a stable id). Recompute the signature as an HMAC-SHA256 over the exact string <timestamp>.<raw request body> using your signing secret, and compare it to the v1 value in constant time. Reject the call if it does not match, and reject it if the timestamp is more than five minutes from your clock — that window stops an old call being replayed.
3. Choose your events
Questions
Where do I get the signing secret?
It is generated when you create the endpoint and shown once in that same response. Rotate the endpoint to get a new one; the old secret stops working immediately.
What exactly do I sign to verify a call?
The string
timestamp.body— the value ofX-Busymate-Timestamp, a literal dot, then the raw request body — with HMAC-SHA256 under your signing secret. Compare the hex result to thev1part ofX-Busymate-Signature.Why did I receive the same event twice?
Delivery is at-least-once, so a retry can repeat an event. Use
X-Busymate-Deliveryas an idempotency key and skip a delivery id you have already handled.