Webhooks
Advanced preview: handle provider callbacks through focused augment routes with deterministic signature checks.
Optional app integration
This surface is not part of the default agent path and does not make Auggy a general application backend. Its API may change before 1.0; pin exact versions and validate authorization and operational boundaries.
Purpose
Advanced preview
Webhook routes are an optional integration surface. Existing application webhook handlers can continue to own provider callbacks and invoke narrow agent tools or notifications only when needed.
Webhooks are provider infrastructure, not chat turns. Verify and handle routine callbacks in code; notify the operator when they fail.
Current support
- Webhook signature policy metadata on route definitions.
- Runtime Stripe and Svix signature verification before the handler runs.
- Webhook policy routes are omitted from browser generated clients.
- Svix verification checks the raw body, signature envelope, delivery ID, and timestamp age before the handler runs.
Pattern
import { defineRoute, webhook } from "auggy";
defineRoute.post("/webhooks/stripe", {
auth: "none",
maxBodyBytes: 64_000,
policy: webhook.signature("stripe", { secretEnv: "STRIPE_WEBHOOK_SECRET" }),
handler: async ({ webhook: verified }) => {
await applyBillingEvent(verified?.event);
return new Response("ok");
},
});For a Svix-signed provider, use `webhook.signature("svix", { secretEnv: "PROVIDER_WEBHOOK_SECRET" })`. AgentMail inbound mounts this policy at `/webhooks/agentmail` and then applies its own inbox, sender, classification, dedup, and turn-admission rules.
Do not model-verify webhooks
Verify provider signatures in code. Do not ask the model whether a callback is valid.