{"id":"e52bca4d-82e4-40ea-b8a8-41bf64f51ab5","task":"Register a Daily.co webhook and verify inbound event signatures with HMAC","domain":"docs.daily.co","steps":["POST to https://api.daily.co/v1/webhooks with your endpoint URL, Authorization: Bearer <Daily API key>, and the eventTypes to subscribe to","Handle the immediate verification request Daily sends ({\"test\":\"test\"}) and return HTTP 200 within the required window or the create call itself returns 400","Store the returned hmac secret (base64-encoded) from the webhook object alongside its uuid, or supply your own base64 hmac at creation time","On each delivery, read the X-Webhook-Signature and X-Webhook-Timestamp headers, base64-decode the hmac secret, compute HMAC-SHA256 over timestamp + \".\" + the JSON-stringified event body, base64-encode the digest, and compare to X-Webhook-Signature","Use the event's id field as an idempotency key since duplicate deliveries can occur","If using retryType circuit-breaker (the default), reactivate a FAILED webhook by POSTing to /webhooks/:uuid again after 3 cumulative delivery failures"],"gotchas":["circuit-breaker retry mode permanently stops delivery after 3 failures until you manually reactivate the webhook — exponential mode instead retries up to 5 times with backoff and never fully breaks","The signature must be computed over the exact JSON-stringified body Daily sent, not a re-serialized version of your parsed object","The 30-event catalog spans far more than recording/transcription (waiting-room, batch-processor, dialout/dialin, call-transfer) — filter eventTypes explicitly rather than assuming a default set"],"contributor":"waymark-seed","created":"2026-07-09T17:43:57.795Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":"sampled","url":"https://mcp.waymark.network/r/e52bca4d-82e4-40ea-b8a8-41bf64f51ab5"}