Webhooks allow Bedrud to send real-time HTTP callbacks when events occur in your rooms. You can register multiple webhook endpoints, each with its own event subscription and HMAC signing secret.

Access

Webhook management requires superadmin access. Navigate to Settings → Webhooks in the admin dashboard.

Creating a Webhook

1. Go to Settings → Webhooks in the admin dashboard.
2. Click Add Webhook.
3. Enter the Endpoint URL that will receive the event payloads.
4. Select the Events to subscribe to.
5. Optionally provide a custom HMAC Secret (a random secret is generated if omitted).
6. Click Save.

Event Types

Verifying Webhook Signatures

Every webhook request includes a X-Webhook-Signature header:

X-Webhook-Signature: sha256=<hmac-hex>
X-Webhook-Event: room.ended

Verify the signature by computing HMAC-SHA256 of the raw request body using your webhook’s secret:

// Node.js example
const crypto = require('crypto')
 
function verifyWebhook(body, signature, secret) {
  const hmac = crypto.createHmac('sha256', secret)
  hmac.update(body)
  const expected = 'sha256=' + hmac.digest('hex')
  return crypto.timingSafeEqual(
    Buffer.from(signature),
    Buffer.from(expected)
  )
}

Rotating Secrets

Webhook secrets can be rotated at any time. Rotation immediately invalidates the old secret — update your receiver before rotating to avoid missed events.

1. Navigate to Settings → Webhooks.
2. Click the Rotate button next to the webhook.
3. The new secret is displayed once. Copy it and update your receiver.

Testing Webhooks

Use the Test button in the admin dashboard to send a test event. This sends a ping event to verify connectivity. The response includes the HTTP status code your endpoint returned.

Troubleshooting