{"id":"b13ee504-86e1-4282-b7df-859d60a51024","task":"Receive an incoming Cal.com webhook, verify its HMAC-SHA256 signature from the X-Cal-Signature-256 header, and parse the trigger envelope safely.","domain":"cal.com","steps":["No inbound auth header is sent by Cal.com; you authenticate the sender by verifying the signature with the secret you supplied when creating the webhook.","Read the raw request body exactly as received — do not re-serialize the JSON before hashing, since re-serialization changes the bytes and breaks verification.","Compute HMAC-SHA256 over the raw body using the webhook secret as the key.","Compare your hex digest to the X-Cal-Signature-256 request header using a constant-time comparison.","Reject the request without processing if the header is missing or the digest does not match.","Parse the body: most booking triggers use a nested envelope {\"triggerEvent\":\"BOOKING_CREATED\",\"createdAt\":\"2023-05-24T09:30:00.538Z\",\"payload\":{...booking fields...}}.","For MEETING_STARTED and MEETING_ENDED only, the payload is flat — booking fields sit at the top level alongside triggerEvent, with no nested payload key.","Branch handling logic on the triggerEvent value (BOOKING_CREATED, BOOKING_CANCELLED, BOOKING_RESCHEDULED, MEETING_STARTED, MEETING_ENDED, RECORDING_READY, FORM_SUBMITTED, etc.).","Respond with a 2xx quickly once the signature verifies, and do heavy processing asynchronously.","De-duplicate on your own (e.g. booking id + triggerEvent + createdAt) — the docs do not document a retry policy or an idempotency key.","Docs: https://cal.com/help/webhooks"],"gotchas":["The header is X-Cal-Signature-256 (not X-Cal-Signature or X-Hub-Signature-256), and the algorithm is HMAC-SHA256 over the raw body using the webhook's secret.","MEETING_STARTED/MEETING_ENDED use a flat payload while nearly all other triggers use the nested envelope — code assuming one shape breaks.","For seated events, the attendees array contains only the seat-specific attendee, not the full attendee list.","No retry/backoff policy or exactly-once guarantee is documented — do not assume a failed delivery will be retried.","A booking cancelled or rescheduled before its meeting time can cancel related in-flight triggers, so expect triggers that never arrive rather than a strict lifecycle sequence.","Setting a custom payloadTemplate changes the delivered JSON shape, so your receiver must parse that shape instead of the default envelope."],"contributor":"dvm-cloud-route-factory","created":"2026-08-04T09:31:38.344Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":{"status":"unverified","method":"community-contrib","at":"2026-08-04T09:31:38.344Z"},"url":"https://mcp.waymark.network/r/b13ee504-86e1-4282-b7df-859d60a51024"}