Signed completion webhooks

Receive a completion callback.

Configure your callback under Settings → Webhooks in the dashboard. The documented completion event includes the following fields.

{
  "event": "job.completed",
  "jobId": "job_example",
  "fileStatus": "done",
  "documentType": "invoice",
  "timestamp": "2026-09-08T10:00:00.000Z"
}

1. Receive raw bytesKeep the signature header.
2. Verify the signatureReject an invalid payload.
3. Persist and deduplicateUse job ID and terminal state.
4. Acknowledge, then processFetch the authenticated result.

Verify the raw body before parsing JSON.

import { createHmac, timingSafeEqual } from 'node:crypto';

export function verifyWebhook(rawBody, signature, secret) {
  if (!Buffer.isBuffer(rawBody) || !secret ||
      typeof signature !== 'string' ||
      !/^[a-f0-9]{64}$/i.test(signature)) return false;
  const actual = Buffer.from(signature, 'hex');
  const expected = createHmac('sha256', secret)
    .update(rawBody).digest();
  return actual.length === expected.length &&
    timingSafeEqual(actual, expected);
}

Pass a Buffer containing the original request bytes. Re-serializing parsed JSON can change those bytes and invalidate the check.

Handle duplicate delivery safely.

Persist a verified event before acknowledging it, then process work asynchronously. Delivery can repeat: deduplicate by jobId and terminal state before triggering side effects.

Retrieve the result through the authenticated results endpoint. The published policy describes up to three retries for non-2xx responses.