Webhooks

curl https://api.lumenfall.ai/openai/v1/videos \
  -H "Authorization: Bearer $LUMENFALL_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "model": "veo-3.1-fast",
    "prompt": "A capybara swimming in a pool",
    "webhook_url": "https://yourapp.com/hooks/lumenfall"
  }'

from openai import OpenAI

client = OpenAI(
    api_key="your-lumenfall-api-key",
    base_url="https://api.lumenfall.ai/openai/v1"
)

# Pass webhook_url as an extra body parameter
response = client.videos.create(
    model="veo-3.1-fast",
    prompt="A capybara swimming in a pool",
    extra_body={
        "webhook_url": "https://yourapp.com/hooks/lumenfall",
    },
)

import OpenAI from "openai";

const client = new OpenAI({
  apiKey: "your-lumenfall-api-key",
  baseURL: "https://api.lumenfall.ai/openai/v1",
});

// Pass webhook_url as an extra body parameter
const response = await client.videos.create({
  model: "veo-3.1-fast",
  prompt: "A capybara swimming in a pool",
  // @ts-expect-error Lumenfall extension
  webhook_url: "https://yourapp.com/hooks/lumenfall",
});

# Retrieve your signing secret
curl https://api.lumenfall.ai/v1/webhooks/secret \
  -H "Authorization: Bearer $LUMENFALL_API_KEY"

import hmac
import hashlib
import base64
import time

def verify_webhook(body: str, headers: dict, secret: str) -> bool:
    msg_id = headers["webhook-id"]
    timestamp = headers["webhook-timestamp"]
    signature = headers["webhook-signature"]

    # Reject old timestamps (replay protection)
    if abs(time.time() - int(timestamp)) > 300:
        raise ValueError("Timestamp too old")

    # Compute expected signature
    key = base64.b64decode(secret.removeprefix("whsec_"))
    to_sign = f"{msg_id}.{timestamp}.{body}".encode()
    expected = base64.b64encode(
        hmac.new(key, to_sign, hashlib.sha256).digest()
    ).decode()

    # Compare (timing-safe)
    _, sig = signature.split(",", 1)
    return hmac.compare_digest(expected, sig)

import crypto from "node:crypto";

function verifyWebhook(
  body: string,
  headers: Record<string, string>,
  secret: string
): boolean {
  const msgId = headers["webhook-id"];
  const timestamp = headers["webhook-timestamp"];
  const signature = headers["webhook-signature"];

  // Reject old timestamps (replay protection)
  const now = Math.floor(Date.now() / 1000);
  if (Math.abs(now - parseInt(timestamp)) > 300) {
    throw new Error("Timestamp too old");
  }

  // Compute expected signature
  const key = Buffer.from(secret.replace("whsec_", ""), "base64");
  const toSign = `${msgId}.${timestamp}.${body}`;
  const expected = crypto
    .createHmac("sha256", key)
    .update(toSign)
    .digest("base64");

  // Compare (timing-safe)
  const [, sig] = signature.split(",");
  return crypto.timingSafeEqual(Buffer.from(expected), Buffer.from(sig));
}

package main

import (
	"crypto/hmac"
	"crypto/sha256"
	"encoding/base64"
	"fmt"
	"math"
	"strconv"
	"strings"
	"time"
)

func verifyWebhook(body string, headers map[string]string, secret string) (bool, error) {
	msgID := headers["webhook-id"]
	timestamp := headers["webhook-timestamp"]
	signature := headers["webhook-signature"]

	// Reject old timestamps
	ts, err := strconv.ParseInt(timestamp, 10, 64)
	if err != nil {
		return false, err
	}
	if math.Abs(float64(time.Now().Unix()-ts)) > 300 {
		return false, fmt.Errorf("timestamp too old")
	}

	// Compute expected signature
	keyStr := strings.TrimPrefix(secret, "whsec_")
	key, err := base64.StdEncoding.DecodeString(keyStr)
	if err != nil {
		return false, err
	}
	mac := hmac.New(sha256.New, key)
	mac.Write([]byte(fmt.Sprintf("%s.%s.%s", msgID, timestamp, body)))
	expected := base64.StdEncoding.EncodeToString(mac.Sum(nil))

	// Compare
	parts := strings.SplitN(signature, ",", 2)
	if len(parts) != 2 {
		return false, fmt.Errorf("invalid signature format")
	}
	return hmac.Equal([]byte(expected), []byte(parts[1])), nil
}

require "openssl"
require "base64"

def verify_webhook(body, headers, secret)
  msg_id = headers["webhook-id"]
  timestamp = headers["webhook-timestamp"]
  signature = headers["webhook-signature"]

  # Reject old timestamps
  raise "Timestamp too old" if (Time.now.to_i - timestamp.to_i).abs > 300

  # Compute expected signature
  key = Base64.decode64(secret.delete_prefix("whsec_"))
  to_sign = "#{msg_id}.#{timestamp}.#{body}"
  expected = Base64.strict_encode64(
    OpenSSL::HMAC.digest("sha256", key, to_sign)
  )

  # Compare (timing-safe)
  _, sig = signature.split(",", 2)
  OpenSSL.secure_compare(expected, sig)
end