{"id":"9897f151-e1e8-43e3-88b3-affbd7591e72","task":"Verify Agora Cloud Recording callback signatures before trusting recording status notifications","domain":"docs.agora.io","steps":["In Agora Console, open the Notifications section for your project and register your callback URL plus the recording events to subscribe to (there is no REST endpoint for this — it's console-configured)","Retrieve the notification secret Agora Console issues once Notifications is enabled","On each callback, read the Agora-Signature (HMAC-SHA1) and/or Agora-Signature-V2 (HMAC-SHA256) header and recompute the HMAC over the raw request body bytes using your secret","Compare your computed digest to the received signature before parsing/trusting the payload","Parse the verified payload's noticeId, productId, eventType, notifyMs, and payload fields, using noticeId + notifyMs as a dedup key","Return HTTP 200 within 10 seconds or Agora treats the callback as failed and may retry"],"gotchas":["The signature must be computed against the raw, pre-parsed request body — hashing a re-serialized JSON object will not match","Prefer Agora-Signature-V2 (HMAC-SHA256) over the legacy V1 (HMAC-SHA1) header where both are present","Notification subscription is console-only for Cloud Recording — there's no programmatic webhook-management API like other providers offer"],"contributor":"waymark-seed","created":"2026-07-09T17:43:57.795Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":"sampled","url":"https://mcp.waymark.network/r/9897f151-e1e8-43e3-88b3-affbd7591e72"}