Webhook signature verification

When submitting an async media job, supply your own callBackUrl and an independent callbackSecret of 32–256 characters. There is no account settings webhookHmacKey to obtain. Do not use your API Key as the callback secret.

Header	Meaning
X-ModelFold-Event-Id	Stable event ID; must match body.eventId
X-ModelFold-Timestamp	Unix seconds for this delivery attempt
X-ModelFold-Signature	Base64 HMAC-SHA256 signature using callbackSecret

The signature covers the complete raw request body:

Base64(HMAC-SHA256(callbackSecret, timestamp + "." + eventId + "." + rawRequestBody))

Verify original bytes before JSON parsing. Reject timestamps differing by more than five minutes, compare signatures in constant time and persistently deduplicate business processing by eventId. Retries retain the event ID and body, with a fresh timestamp/signature.

Both success and failure send task.completed; inspect data.state. Persist receipt and acknowledge with any 2xx within ten seconds. Network errors, timeouts and non-2xx responses retry up to ten total attempts, without following redirects. Notification failures do not alter task billing; polling remains available.

See Node.js verification code, payloads, retries and polling. Customer callback signing is separate from ModelFold's internal upstream webhook verification.