Event delivery · project and API events
Connect LEO OS events to your systems.
Configure HTTPS endpoints, subscribe to project and API events, copy the signing secret once, inspect deliveries, and retry failures. Delivery retries are stored with backoff, but the current scheduled worker runs daily; retry timing is therefore not near-real-time.
Webhooks
LEO OS sends signed HTTPS POST requests to your URL when events happen. Failed deliveries are retried with increasing delays.
HTTPS only, public hosts only. Up to 5 endpoints. Project and API events are sent when their real operations complete; test delivery is sent only when you request it.
Loading…
Verify signatures (Node.js)
import { createHmac, timingSafeEqual } from 'node:crypto';
// header = request.headers['leo-signature'] // "t=...,v1=..."
function verify(secret, header, rawBody) {
const p = Object.fromEntries(header.split(',').map(x => x.split('=')));
if (Math.abs(Date.now() / 1000 - Number(p.t)) > 300) return false;
const expected = createHmac('sha256', secret).update(p.t + '.' + rawBody).digest('hex');
return expected.length === p.v1.length &&
timingSafeEqual(Buffer.from(expected), Buffer.from(p.v1));
}