TempoLife › Features › Automations and webhooks › raw-webhooks

Raw webhooks

Register an https endpoint, verify an HMAC-SHA256 signature over the raw body, handle retries idempotently. Registration is open; deliveries begin when the worker ships.

Your own endpointSignature: HMAC-SHA256Checked 2026-09-02

No deliveries are being sent. The delivery worker is not built, so a webhook registered today records your URL, your event and your signing secret and then sits there — TempoLife makes no outbound request to it, not even a test ping. Registering now is only worth doing if you want the secret ahead of time so you can write and unit-test your verification code. Deliveries begin when the worker ships.

What a raw webhook gets you

No intermediary, no per-task pricing, no data leaving your infrastructure through a third party. TempoLife posts JSON to a URL you control, signed so you can prove it came from TempoLife, and you do whatever you like with it: write a row, update a dashboard, send yourself a message, feed a model. The cost is that you own the endpoint, the retries and the deduplication.

If you have not built a webhook receiver before, the shape is smaller than it sounds. An HTTPS route that reads the raw body, checks one header, returns 200 quickly and queues the real work. Everything hard about webhooks is in that word "quickly", and in remembering that the same event can arrive twice.

Requirements for your endpoint

Those rules are enforced by the registration form on this page, not merely recommended. They exist because a webhook target is a URL a user gives a server and asks it to fetch — the classic server-side-request-forgery shape. Refusing internal addresses at registration is the first line of that defence; the delivery worker will re-check the resolved address at send time, because a hostname that is public today can be repointed at an internal address tomorrow.

A complete receiver

Verify, acknowledge, then work. In that order.

<?php
// POST /tempolife-webhook
declare(strict_types=1);

const TOLERANCE = 300;
$secret = (string)getenv('TEMPOLIFE_WEBHOOK_SECRET');
$raw    = (string)file_get_contents('php://input');
$header = (string)($_SERVER['HTTP_X_TEMPOLIFE_SIGNATURE'] ?? '');

function tl_verify(string $secret, string $header, string $raw): bool {
    if (preg_match('/(?:^|,)\s*t=(\d{1,12})\s*(?:,|$)/', $header, $mt) !== 1) return false;
    if (preg_match('/(?:^|,)\s*v1=([0-9a-f]{64})\s*(?:,|$)/i', $header, $mv) !== 1) return false;
    if (abs(time() - (int)$mt[1]) > TOLERANCE) return false;
    return hash_equals(hash_hmac('sha256', $mt[1] . '.' . $raw, $secret), strtolower($mv[1]));
}

if (!tl_verify($secret, $header, $raw)) { http_response_code(401); exit; }

$event = json_decode($raw, true);
if (!is_array($event) || !isset($event['id'], $event['type'])) { http_response_code(400); exit; }

// Idempotency before side effects.
if (already_seen($event['id'])) { http_response_code(200); exit; }
remember($event['id']);

http_response_code(200);          // acknowledge first
fastcgi_finish_request();         // then do the slow part off the request

match ($event['type']) {
    'meal.logged'        => on_meal($event['data']),
    'weight.updated'     => on_weight($event['data']),
    'steps.goal_reached' => on_goal($event['data']),
    'fast.completed'     => on_fast($event['data']),
    default              => null, // unknown types are normal; ignore them
};

Note the default => null. New event types will appear, and a receiver that throws on one it has never seen will start failing deliveries for events it does not even care about.

Common ways this goes wrong

• Re-encoding the body before verifying. Frameworks that hand you a parsed object have already thrown away the exact bytes. Ask for the raw body explicitly.
• Comparing signatures with ==. Use a constant-time comparison.
• Doing the work before answering. Slow handlers get retried, and retried work gets double-counted.
• Ignoring the timestamp. Without the tolerance check, a captured request stays valid forever.
• Allowlisting by IP instead of verifying. Addresses change; the signature does not.

Register a webhook

Webhooks belong to an account. Sign in to register one — everything else on this page is public and does not need an account.

Sign inCreate an account

Frequently asked questions

Source: TempoLife platform specification — event, signature and retry policy · checked 2026-09-02

Other platforms

Payloads, signing and the retry policy · Developer API