Events

Verify webhook deliveries

Vaani signs every webhook delivery with HMAC-SHA256 over the raw request body. Subscribe in the dashboard, then verify the X-Vaani-Signature header in your handler before trusting the payload.

The signing secret is shown once when you create the subscription. Compare with crypto.timingSafeEqual(or your language's equivalent) to avoid timing leaks.

curl https://www.vaanilabs.in/api/webhooks/subscriptions \
  -H "Authorization: Bearer vv_live_REPLACE_ME" \
  -H "Content-Type: application/json" \
  -d '{
    "url": "https://example.com/vaani-webhook",
    "events": ["call.completed", "call.failed"]
  }'

# Response includes a signing_secret. Save it; it is only shown once.

Vaani retries failed deliveries with exponential backoff for 24h. Respond 2xx within 5 seconds.

Open in Replit Download as zip Webhooks reference

Replit and zip downloads are placeholders for now — bucket wiring is tracked as a follow-up.