Task runs and workflows send status updates via Server-Sent Events (SSE) or webhooks. An attacker could forge a webhook to interrupt your pipeline or replay old events. Coasty signs each event with an HMAC header so you can verify authenticity before acting.
How webhook verification works
When Coasty creates a run it generates a webhook_url. Coasty sends a POST request with a JSON payload and an HMAC signature in the header Coasty-Signature. The header format is t=unix_timestamp,v1=hex_digest. To verify you compute the HMAC of the raw request body using the secret key from your Coasty API key. If the computed digest matches the v1 part the payload is authentic.
import hmac
import hashlib
import base64
import os
COASTY_API_KEY = os.getenv("COASTY_API_KEY")
# Coasty signs the raw body with HMAC-SHA256 using your API key secret.
# The secret is the trailing part of your API key after the prefix.
def verify_hmac_signature(raw_body, header_value):
if not header_value:
return False
try:
t_str, v1_str = header_value.split(",")
timestamp = int(t_str.split("=")[1])
expected_v1 = v1_str.split("=")[1]
except Exception:
return False
# Decode the Hex HMAC digest to raw bytes
received_digest = bytes.fromhex(expected_v1)
# Compute HMAC-SHA256 of the raw body using the secret part of your key
secret = COASTY_API_KEY.split("-")[-1].encode("utf-8")
computed_digest = hmac.new(secret, raw_body, hashlib.sha256).digest()
return hmac.compare_digest(computed_digest, received_digest)
# Example usage:
# raw_body = b'{"run_id":"abc","status":"succeeded","..."}'
# header_value = "t=1716000000,v1=a1b2c3..."
# if verify_hmac_signature(raw_body, header_value):
# print("Webhook is valid")
# else:
# print("Invalid signature")Webhook flow with task runs and workflows
- POST /v1/runs creates a run with a webhook_url field. Coasty sends POST payloads to that URL on status changes (queued, running, succeeded, failed, cancelled, timed_out).
- POST /v1/workflows defines a versioned JSON workflow. Workflow runs also POST to the same webhook_url on each step and final outcome.
- GET /v1/runs/{id}/events streams Server-Sent Events for real-time progress, but Coasty also delivers POST webhooks for guaranteed delivery.
- Billing is unaffected by webhooks. Task steps are $0.05 each regardless of how you receive status updates.
Always compute HMAC-SHA256 on the raw request body and compare digests with hmac.compare_digest to avoid timing attacks.
Where this beats brittle automation
API-only tools rely on hard selectors and fragile endpoints. A UI change can break them instantly. The computer use API lets you inspect full screenshots and act like a human, so you don’t need brittle selectors. Webhook verification ensures that your orchestrator only reacts to events you can trust, so your workflow stays robust even when the UI changes.
Add HMAC verification to your computer use agent integrations to keep your workflows secure and reliable. Generate a key at https://coasty.ai/developers and start building robust, event-driven agents.
Want to see this in action?
View Case Studies