Delivery

Webhooks

Instead of polling, pass a callbackUrl (and webhookSecret) on any job. PicoBerry POSTs a signed event when it finishes.

Delivery

delivery

POST <your callbackUrl>
X-PB-Delivery-Id: 7f3a…      # dedupe on this
X-PB-Signature: t=1720252800,v1=<hex>

{ "event": "asset.succeeded", "deliveryId": "7f3a…",
  "data": { /* same shape as GET /v1/assets/{id} */ } }

Verify the signature

v1 is the HMAC-SHA256 of "<t>.<raw-body>" keyed with your secret. Compare in constant time; dedupe on X-PB-Delivery-Id.

verify

const [t, v1] = header.split(",").map(p => p.split("=")[1]);
const expected = crypto.createHmac("sha256", secret).update(`${t}.${rawBody}`).digest("hex");
if (!crypto.timingSafeEqual(Buffer.from(v1), Buffer.from(expected))) reject();

t, v1 = dict(p.split("=") for p in header.split(",")).values()
expected = hmac.new(secret, f"{t}.{raw_body}".encode(), hashlib.sha256).hexdigest()
if not hmac.compare_digest(v1, expected): reject()

// identical to the Node example on the curl tab