Webhooks

Instead of polling, let AutoReel tell your server when work finishes. Each event is a signed JSON POST to an HTTPS endpoint you choose. Webhooks are included with the Pro and Agency plans.

Add an endpoint

In your workspace, open Settings → Webhooks (or call POST /v1/webhooks), enter an HTTPS URL and pick the events you want. You get the endpoint's signing secret, starting with whsec_. It's shown once; store it like a password. You can rotate it at any time, and the old one stops working.

Events

What a delivery looks like

POST /webhooks/autoreel HTTP/1.1
Content-Type: application/json
AutoReel-Signature: t=1768469400,v1=5f2b…
AutoReel-Event: reel.exported
AutoReel-Delivery: 9d8c7b6a-…

{"id":"0b9e4c1a-…","type":"reel.exported","createdAt":"2026-01-15T09:30:00.000Z","data":{"reelId":"6f1c2e8a-…","exportId":"9d8c7b6a-…","resolution":"1080p"}}

The body carries the event's id, type, createdAt and a small data object with ids and status. Fetch the resource from the API for the full details.

Verify the signature

Check every delivery before you trust it. The AutoReel-Signature header has two parts: t, the time it was signed (Unix seconds), and v1, a hex HMAC-SHA256 of the string t + . + the raw request body, keyed with your signing secret.

1. Read the raw body exactly as it arrived. Parse the JSON only after verifying.
2. Split the header on commas and read t and v1.
3. Reject the request if t is more than five minutes from now (this stops replays).
4. Compute the HMAC of t.body with your secret and compare it to v1 in constant time.

In Node.js:

import crypto from "node:crypto";

function verifyAutoReelSignature(rawBody, header, secret, toleranceSeconds = 300) {
  const parts = Object.fromEntries(
    String(header ?? "").split(",").map((part) => part.trim().split("=")),
  );
  const timestamp = Number(parts.t);
  if (!Number.isInteger(timestamp)) return false;
  if (Math.abs(Date.now() / 1000 - timestamp) > toleranceSeconds) return false;
  const expected = crypto.createHmac("sha256", secret).update(`${timestamp}.${rawBody}`).digest();
  const received = Buffer.from(String(parts.v1 ?? ""), "hex");
  return received.length === expected.length && crypto.timingSafeEqual(received, expected);
}

The API reference has a complete Express receiver.

Respond quickly

Answer with any 2xx status within 10 seconds, then do slow work in the background. Redirects don't count as success.

Retries

If a delivery fails, we try again after 1 minute, 5 minutes, 30 minutes, 2 hours and 6 hours: six attempts in all. The same event can arrive more than once, so skip ids you've already handled.

After 20 failed deliveries in a row, the endpoint is switched off and its owners are notified. Fix the receiver and switch it back on in Settings → Webhooks, where the delivery log keeps 30 days of attempts.