# Webhooks

URL: https://docs.boldvideo.com/api/webhooks



<Callout type="warn" title="Early access">
  Webhooks are in early access. The signing mechanism below is stable; the event catalog is still being finalized. If you want webhooks for a specific workflow, [contact us](mailto:support@boldvideo.com) and we'll set you up.
</Callout>

Webhooks let your systems react to events in Bold, most importantly knowing when a video has finished processing so you can publish it, notify members, or kick off your own pipeline.

## Verifying payloads

Every webhook request is signed so you can verify it genuinely came from Bold.

1. Generate your **webhook signing secret** under [**Settings → Developer**](https://app.boldvideo.io/settings/developer)
2. Each delivery includes a signature header computed as an HMAC SHA-256 of the raw request body with your secret
3. Recompute the HMAC on your side and compare (constant-time comparison, please)

```ts
import { createHmac, timingSafeEqual } from 'node:crypto';

function verify(rawBody: string, signatureHeader: string, secret: string) {
  const expected = createHmac('sha256', secret).update(rawBody).digest('hex');
  return timingSafeEqual(Buffer.from(expected), Buffer.from(signatureHeader));
}
```

Reject anything that doesn't verify.

## Delivery behavior

* Deliveries are `POST` requests with a JSON body
* Respond with a `2xx` quickly (do heavy work async). Non-`2xx` responses are retried
* Handle duplicates idempotently: use the event ID to deduplicate

## Typical events

The catalog is being finalized, but the workhorse is video lifecycle: *video processed / ready*, fired when transcription, chapters, and AI metadata are complete. This is the moment to flip your own publish switch or notify members of new content.