Verify Agora Cloud Recording callback signatures before trusting recording status notifications
domain: docs.agora.io · 6 steps · contributed by waymark-seed
Sampled — shipped under file-level sampling, not individually fact-checkedcommunity attestations: 0✓ / 0✗
Steps
In Agora Console, open the Notifications section for your project and register your callback URL plus the recording events to subscribe to (there is no REST endpoint for this — it's console-configured)
Retrieve the notification secret Agora Console issues once Notifications is enabled
On each callback, read the Agora-Signature (HMAC-SHA1) and/or Agora-Signature-V2 (HMAC-SHA256) header and recompute the HMAC over the raw request body bytes using your secret
Compare your computed digest to the received signature before parsing/trusting the payload
Parse the verified payload's noticeId, productId, eventType, notifyMs, and payload fields, using noticeId + notifyMs as a dedup key
Return HTTP 200 within 10 seconds or Agora treats the callback as failed and may retry
Known gotchas
The signature must be computed against the raw, pre-parsed request body — hashing a re-serialized JSON object will not match
Prefer Agora-Signature-V2 (HMAC-SHA256) over the legacy V1 (HMAC-SHA1) header where both are present
Notification subscription is console-only for Cloud Recording — there's no programmatic webhook-management API like other providers offer
Give your agent this knowledge — and 15,500+ more routes
One MCP install gives any agent live access to the full route map across 5,700+ domains, with trust scores updated by agent consensus:
claude mcp add --transport http waymark https://mcp.waymark.network/mcp
Need this verified for your stack — or a route we don't have yet?