Skip to content

Clean up webhook code #717

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
FabienLavocat wants to merge 3 commits into
base: main
Choose a base branch
from
Open

Clean up webhook code #717

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
5e8595f
Clean up webhook code
FabienLavocat Jul 1, 2026
10fb208
Update thumbnail.mdx
FabienLavocat Jul 1, 2026
0cb27e3
Format
FabienLavocat Jul 1, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
22 changes: 10 additions & 12 deletions millicast/webhooks/index.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -117,22 +117,20 @@ The platform will send a `POST` request to the _Webhook url_ specified when the

### How-to verify the webhook

A signature verification header, `X-Millicast-Signature`, is included in the callback request. This SHA1 signature uses the _Webhook secret_ so that you may verify the origin and data integrity.
A signature verification header, `x-millicast-signature`, is included in the callback request. This SHA1 signature uses the _Webhook secret_ so that you may verify the origin and data integrity.
Comment thread
devin-ai-integration[bot] marked this conversation as resolved.

Here is a code sample for how to use the signature to check the data.

```Text title="Node.js"
```javascript title="Node.js"
const webhookSecretBuffer = Buffer.from(webhookSecret, 'base64');
const calculatedSignature = 'sha1=' + Crypto.createHmac('sha1', webhookSecretBuffer)
.update(body)
.digest('hex');
const headerSignature = request.get('X-Millicast-Signature');

if (calculatedSignature !== headerSignature) {
console.warn('Invalid signature sent to us, unsafe data');
res.status(400).send('BAD SIGNATURE');
return;
}
const calculatedSignature = 'sha1=' + Crypto.createHmac('sha1', webhookSecretBuffer).update(body).digest('hex');
const headerSignature = request.get('x-millicast-signature');
Comment thread
FabienLavocat marked this conversation as resolved.

if (calculatedSignature !== headerSignature) {
console.warn('Invalid signature sent to us, unsafe data');
res.status(400).send('BAD SIGNATURE');
return;
}
```

### Webhook schema
Expand Down
10 changes: 5 additions & 5 deletions millicast/webhooks/thumbnail.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -62,11 +62,11 @@ The thumbnail webhook is a POST request that will be sent to the webhook URL wit

The following HTTP headers are on the request to identify stream details:

- **X-Millicast-Timestamp**: timestamp of the generated thumbnail.
- **X-Millicast-Feed-Id**: OptiView Real-time Streaming feed id.
- **X-Millicast-Stream-Id**: OptiView Real-time Streaming stream id.
- **X-Millicast-Token-Id**: OptiView Real-time Streaming publish token id.
- **X-Millicast-Signature**: SHA1 signature using the hook configured secret (The same signature mechanism used by the other webhooks).
- **x-millicast-timestamp**: timestamp of the generated thumbnail.
- **x-millicast-feed-id**: OptiView Real-time Streaming feed id.
- **x-millicast-stream-id**: OptiView Real-time Streaming stream id.
- **x-millicast-token-id**: OptiView Real-time Streaming publish token id.
- **x-millicast-signature**: SHA1 signature using the hook configured secret (The same signature mechanism used by the other webhooks).

## Troubleshooting

Expand Down
Loading