Receive and verify Mux webhook events (e.g. video.asset.ready, video.live_stream.active/idle)

Steps

1. Configure a webhook endpoint URL under Settings in the Mux Dashboard; webhooks are scoped per environment, so a URL configured in one environment won't receive events from another.
2. Handle the POST body Mux sends, keyed by a `type` field (e.g. `video.asset.ready`, `video.asset.errored`, `video.live_stream.active`, `video.live_stream.idle`, `video.upload.asset_created`) plus an `object`, `data`, and `environment` block.
3. Respond with a 2xx status within 5 seconds — a single delivery attempt times out at 5 seconds and is retried; do slow work asynchronously and ack immediately.
4. To verify authenticity, read the `Mux-Signature` header (format `t=<timestamp>,v1=<hex signature>`), build `signed_payload = timestamp + '.' + raw_body`, and compute HMAC-SHA256 over it using your per-endpoint signing secret from the Mux Dashboard webhook settings.
5. Compare your computed signature to the `v1` value (constant-time compare) and also check the `t` timestamp is within tolerance (SDKs default to 5 minutes) to guard against replay.
6. For local development, use the Mux CLI (`mux webhooks listen --forward-to <url>`) or `mux webhooks trigger video.asset.ready --forward-to <url>` to forward/simulate events instead of polling the rate-limited Assets API.