> ## Documentation Index
> Fetch the complete documentation index at: https://docs.trycarhub.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Receive webhooks

> Verify and deduplicate job events from CarHub.

Configure webhook destinations in the CarHub dashboard. CarHub sends `job.succeeded`, `job.failed` and inspection-stage events so you do not need to poll every job.

## Verify every request

| Header                    | Purpose                                |
| ------------------------- | -------------------------------------- |
| `Carhub-Signature`        | `t=<epoch>,v1=<HMAC-SHA256>` signature |
| `Carhub-Event-Id`         | Stable event identifier across retries |
| `Carhub-Delivery-Attempt` | Starts at `1`, increases on retry      |

Compute HMAC-SHA256 over the exact string `<timestamp>.<raw request body>` with the webhook endpoint secret. Compare signatures in constant time and reject timestamps older than five minutes.

```text theme={null}
signed_payload = "1700000000." + raw_body
expected = HMAC_SHA256(webhook_secret, signed_payload)
```

## Respond and deduplicate

Return any `2xx` only after durably recording or processing the event. CarHub retries non-`2xx` deliveries. Use `Carhub-Event-Id` as your idempotency key because retries represent the same event.

<Tip>Keep webhook handling short: verify, persist and acknowledge. Let a background worker perform slow downstream work.</Tip>

The endpoint secret is returned only when the destination is created. Store it as securely as your API key.