Webhooks

Async rendering is used for large documents and bulk jobs. Pass webhookUrl with a request and we POST a signed event when the document is ready.

{
  "event": "document.ready",
  "requestId": "req_9f2c4a7b1d",
  "pages": 4,
  "creditsCharged": 4,
  "downloadUrl": "https://…/d/…?expires=…",
  "expiresAt": "2026-11-06T10:00:00Z"
}

Verifying signatures

Each request carries X-Pdfpilot-Signature, an HMAC-SHA256 of the raw body using your webhook secret. Compare with a constant-time function.

import { createHmac, timingSafeEqual } from "node:crypto";

function verify(raw, signature, secret) {
  const expected = createHmac("sha256", secret).update(raw).digest("hex");
  return timingSafeEqual(Buffer.from(expected), Buffer.from(signature));
}

Delivery rules

• Retries: 6 attempts with exponential backoff over 24 hours.
• Any 2xx is treated as delivered.
• Webhook endpoints must be public; private IPs are rejected.
• Always respond within 5 seconds and process asynchronously.

Async delivery ships in phase 2.