Handle report completion

Use job polling as the reliable baseline for every asynchronous report. Account-level report delivery can additionally send report.completed and report.failed events to an HTTPS destination configured in the AstroM8 dashboard.

Verify the signature

Webhook deliveries include:

X-Astrom8-Timestamp: 1721808000
X-Astrom8-Signature: sha256=<hmac-sha256(secret, timestamp + "." + raw_body)>

Verify the signature against the exact raw request body before parsing it. Reject a timestamp outside your replay window, compare signatures in constant time, and return a 2xx response only after accepting the event.

import { createHmac, timingSafeEqual } from 'node:crypto'

const signed = `${timestamp}.${rawBody}`
const expected = `sha256=${createHmac('sha256', signingSecret).update(signed).digest('hex')}`
const valid = timingSafeEqual(Buffer.from(signature), Buffer.from(expected))

Delivery behavior

Deliveries are retried with backoff after transient failure. Your handler must be idempotent because an event may be delivered more than once. Store the event or job identifier before performing downstream work. Webhook-management operations in the reference are customer-session authenticated. Configure destinations and review delivery history in the dashboard or through that session-authenticated API; never log the one-time signing secret.

Start here

Build and operate

Handle report completion

Verify the signature

Delivery behavior

​Verify the signature

​Delivery behavior

Verify the signature

Delivery behavior