Webhooks

Add an endpoint in Settings → Developers → Webhooks. Pellio shows its signing secret once. Send test sends a webhook.test event, and Deliveries shows recent attempts and responses.

Events

• video.created, video.ready, video.failed, video.deleted
• lead.captured: someone submitted an email form

Failed deliveries (network errors or non-2xx responses) are retried up to six times with exponential backoff.

Verifying signatures

Each request has a Pellio-Signature header: t=<unix time>,v1=<hex HMAC-SHA256 of "t.body">, using your endpoint’s secret. Verify it against the raw request body:

import { createHmac, timingSafeEqual } from 'node:crypto';

function verify(header, rawBody, secret) {
  const { t, v1 } = Object.fromEntries(header.split(',').map((p) => p.split('=')));
  if (Math.abs(Date.now() / 1000 - Number(t)) > 300) return false; // 5-minute tolerance
  const expected = createHmac('sha256', secret).update(`${t}.${rawBody}`).digest('hex');
  return timingSafeEqual(Buffer.from(expected), Buffer.from(v1));
}