Receive and verify Tekma webhooks

Owners configure endpoints under Settings → Webhooks. Enter a public HTTPS URL that does not contain credentials or resolve to a private network. Redirects are not followed. The signing secret is shown once; store it in your receiver’s secret storage. Select at least one event and choose Send test after deployment. Current subscribable event names are capture.ready, capture.processing_ready, intercom.recorder.recorded, intercom.recorder.opted_out, and recording_link.created.

Verify the raw request

Tekma signs <timestamp>.<raw body> with HMAC-SHA256. Verify before parsing or reserializing JSON:

import { createHmac, timingSafeEqual } from 'node:crypto';

export function verifyWebhook(rawBody, headers, secret, now = Date.now()) {
  const timestamp = headers.get('x-capture-timestamp');
  const signature = headers.get('x-capture-signature-256');
  if (!timestamp || !/^\d+$/.test(timestamp)) return false;
  if (Math.abs(now - Number(timestamp)) > 5 * 60 * 1000) return false;
  if (!signature || !/^v1=[a-f0-9]{64}$/.test(signature)) return false;
  const expected = createHmac('sha256', secret)
    .update(timestamp + '.')
    .update(rawBody)
    .digest();
  const received = Buffer.from(signature.slice(3), 'hex');
  return received.length === expected.length &&
    timingSafeEqual(received, expected);
}

X-Capture-Timestamp is Unix time in milliseconds. Record X-Capture-Delivery, which remains the same across retries, and reject stale timestamps. X-Capture-Event identifies the event. capture.ready is emitted when a capture is ready; capture.processing_ready reports that an individual recording-processing job reached ready, including its job ID, media asset ID and kind. Do not assume these events arrive in a fixed order. The Intercom events describe a completed recording or explicit opt-out, and recording_link.created describes a new request link. Use the event name to choose payload handling rather than assuming every event has a capture.

Acknowledge and recover

Return a 2xx response within five seconds and queue longer work. Persist the delivery ID before processing so retries do not duplicate work. Tekma retries failed deliveries with exponential backoff and stops automatically after eight attempts. Use Retry in the delivery history after repairing your receiver; Send test uses the same signature mechanism. Deactivating an endpoint stops pending deliveries. A webhook points to a capture subject to its normal access policy; it does not make the capture public.

Get connected

Record and import

MCP

Reference and automation

Receive and verify Tekma webhooks

Verify the raw request

Acknowledge and recover

​Verify the raw request

​Acknowledge and recover

Verify the raw request

Acknowledge and recover