Receive and verify Tekma webhooks

Webhooks notify your service when a capture becomes ready. Workspace owners configure endpoints under Settings → Webhooks.

Create an endpoint

Enter a public HTTPS destination. Store the signing secret shown when the endpoint is created; it is shown once. Use Send test to confirm your receiver can accept a delivery. The destination must not contain credentials or resolve to a private network. Redirects are not followed, so enter the final HTTPS URL directly.

Verify every request

Tekma sends these headers:

Header	Meaning
`X-Capture-Delivery`	Delivery identifier for deduplication
`X-Capture-Event`	Event name, including `capture.ready`
`X-Capture-Timestamp`	Unix timestamp in milliseconds
`X-Capture-Signature-256`	`v1=` followed by a hexadecimal HMAC-SHA256 signature

The signed message is the timestamp, a period, and the exact raw request body: <timestamp>.<raw body>. Verify before parsing or processing the payload. Do not reserialize JSON before checking the signature.

import { createHmac, timingSafeEqual } from 'node:crypto';

export function verifyWebhook(rawBody, headers, secret, now = Date.now()) {
  const timestamp = headers.get('x-capture-timestamp');
  const signature = headers.get('x-capture-signature-256');
  if (!timestamp || !/^\d+$/.test(timestamp)) return false;
  if (Math.abs(now - Number(timestamp)) > 5 * 60 * 1000) return false;
  if (!signature || !/^v1=[a-f0-9]{64}$/.test(signature)) return false;
  const expected = createHmac('sha256', secret)
    .update(timestamp + '.')
    .update(rawBody)
    .digest();
  const received = Buffer.from(signature.slice(3), 'hex');
  return received.length === expected.length &&
    timingSafeEqual(received, expected);
}

Pass a Buffer containing the unmodified body and a Headers-compatible object. Load the signing secret from your receiver’s secret storage, not source code.

Handle retries

Deliveries time out after five seconds. Acknowledge accepted events promptly and move longer work into your own background queue. Persist the delivery identifier so repeated attempts do not create duplicate work. Failed deliveries are retried with exponential backoff. After eight attempts, automatic retries stop. Use Retry in settings after fixing the receiver. Send test and Retry use the same signed delivery mechanism. Deactivating an endpoint stops pending deliveries from being sent. Monitor receiver errors and the delivery results in Tekma when troubleshooting.

Start here

Record and review

Share and collaborate

Your workspace

Developers and agents

Help

Receive and verify Tekma webhooks

Create an endpoint

Verify every request

Handle retries

​Create an endpoint

​Verify every request

​Handle retries

Create an endpoint

Verify every request

Handle retries