Webhooks

Webhooks let your systems react to events in Bold, most importantly knowing when a video has finished processing so you can publish it, notify members, or kick off your own pipeline.

Verifying payloads

Every webhook request is signed so you can verify it genuinely came from Bold.

1. Generate your webhook signing secret under Settings → Developer
2. Each delivery includes a signature header computed as an HMAC SHA-256 of the raw request body with your secret
3. Recompute the HMAC on your side and compare (constant-time comparison, please)

import { createHmac, timingSafeEqual } from 'node:crypto';

function verify(rawBody: string, signatureHeader: string, secret: string) {
  const expected = createHmac('sha256', secret).update(rawBody).digest('hex');
  return timingSafeEqual(Buffer.from(expected), Buffer.from(signatureHeader));
}

Reject anything that doesn't verify.

Delivery behavior

• Deliveries are POST requests with a JSON body
• Respond with a 2xx quickly (do heavy work async). Non-2xx responses are retried
• Handle duplicates idempotently: use the event ID to deduplicate

Typical events

The catalog is being finalized, but the workhorse is video lifecycle: video processed / ready, fired when transcription, chapters, and AI metadata are complete. This is the moment to flip your own publish switch or notify members of new content.