Webhook signatures

Operade signs successful post-call Analysis delivery so a receiver can authenticate the exact bytes it received. This contract is separate from Telegram's provider callback verification.

Delivery conditions#

A post-call webhook is sent only after Analysis reaches a successful done result. Skipped or failed Analysis does not produce a delivery. The JSON payload includes safe Conversation metadata, transcript data, and the Analysis result documented by the workspace webhook guide.

Operade serializes the JSON body once, signs those raw bytes, and sends the same bytes. The request includes:

ElevenLabs-Signature: t=TIMESTAMP,v0=HEX_DIGEST

The header name is retained by the current compatibility contract. The digest is HMAC-SHA256 over TIMESTAMP + "." + RAW_BODY, keyed by the one-time signing secret.

Verification#

Read the raw body as bytes before parsing JSON. Parse t and v0, build the signed byte sequence from the timestamp text, a period, and the unchanged body, then compute HMAC-SHA256 with the workspace signing secret. Compare digests with a constant-time comparison. Reject a mismatch before using the payload.

The receiver must enforce its own acceptable timestamp age and replay policy. Operade supplies the signed timestamp but does not claim that the receiver's freshness check is automatic.

Retries#

Delivery makes three attempts with delays of 1, 2, and 4 seconds. The timestamp and body remain the same across those attempts. Only HTTP 200 counts as success; another 2xx status is retried and ultimately recorded as failure. Receivers should therefore make processing idempotent for the same signed delivery.

Secret handling#

The signing secret is shown once when the webhook is created. Store it securely and never log the signature input together with the secret. If it is lost or compromised, disable delivery with the existing webhook update control, then contact Support or Operade. There is no self-service recovery, reset, rotation, or delete operation, and changing the URL or Enabled state does not issue another secret.

See Post-call webhook, Analysis results, and Support.