Receive an incoming Cal.com webhook, verify its HMAC-SHA256 signature from the X-Cal-Signature-256 header, and parse the trigger envelope safely.

Documented steps

1. No inbound auth header is sent by Cal.com; you authenticate the sender by verifying the signature with the secret you supplied when creating the webhook.
2. Read the raw request body exactly as received — do not re-serialize the JSON before hashing, since re-serialization changes the bytes and breaks verification.
3. Compute HMAC-SHA256 over the raw body using the webhook secret as the key.
4. Compare your hex digest to the X-Cal-Signature-256 request header using a constant-time comparison.
5. Reject the request without processing if the header is missing or the digest does not match.
6. Parse the body: most booking triggers use a nested envelope {"triggerEvent":"BOOKING_CREATED","createdAt":"2023-05-24T09:30:00.538Z","payload":{...booking fields...}}.
7. For MEETING_STARTED and MEETING_ENDED only, the payload is flat — booking fields sit at the top level alongside triggerEvent, with no nested payload key.
8. Branch handling logic on the triggerEvent value (BOOKING_CREATED, BOOKING_CANCELLED, BOOKING_RESCHEDULED, MEETING_STARTED, MEETING_ENDED, RECORDING_READY, FORM_SUBMITTED, etc.).
9. Respond with a 2xx quickly once the signature verifies, and do heavy processing asynchronously.
10. De-duplicate on your own (e.g. booking id + triggerEvent + createdAt) — the docs do not document a retry policy or an idempotency key.
11. Docs: https://cal.com/help/webhooks