Receive webhooks

Verify and deduplicate job events from CarHub.

Configure webhook destinations in the CarHub dashboard. CarHub sends job.succeeded, job.failed and inspection-stage events so you do not need to poll every job.

Verify every request

Header	Purpose
Carhub-Signature	t=<epoch>,v1=<HMAC-SHA256> signature
Carhub-Event-Id	Stable event identifier across retries
Carhub-Delivery-Attempt	Starts at 1, increases on retry

Compute HMAC-SHA256 over the exact string <timestamp>.<raw request body> with the webhook endpoint secret. Compare signatures in constant time and reject timestamps older than five minutes.

signed_payload = "1700000000." + raw_body
expected = HMAC_SHA256(webhook_secret, signed_payload)

Respond and deduplicate

Return any 2xx only after durably recording or processing the event. CarHub retries non-2xx deliveries. Use Carhub-Event-Id as your idempotency key because retries represent the same event.

Keep webhook handling short: verify, persist and acknowledge. Let a background worker perform slow downstream work.

The endpoint secret is returned only when the destination is created. Store it as securely as your API key.