Verify Computer Use API Webhooks with HMAC Signatures
Task runs return progress via Server-Sent Events streamed from GET /v1/runs/{id}/events. Your server must validate each event before trusting it. Coasty signs every webhook payload with HMAC SHA-256 under the header Coasty-Signature: t=unix,v1=hex. Mis-signed events are rejected.
How webhook verification works
Coasty signs each event under the Coasty-Signature header. The value follows the format t={unix_timestamp},v1={hex_signature}. To verify, extract the timestamp and signature from the header, fetch the secret key from your wallet, compute HMAC-SHA-256 of the event body with that secret, and compare the hex result to the v1 field. Matching signatures and timestamps in the same second are considered valid.
curl -X GET 'https://coasty.ai/v1/runs/run_abc123/events' \
-H 'X-API-Key: $COASTY_API_KEY' \
-H 'Accept: text/event-stream' \
-NCompute and compare signatures
- ●Read the Coasty-Signature header from each event.
- ●Parse t={unix},v1={hex} into timestamp and signature.
- ●Retrieve your signing secret from the Coasty dashboard.
- ●HMAC-SHA-256 the raw body bytes against the secret.
- ●Hex-encode the digest and compare with the v1 field.
- ●Reject events where v1 mismatches or timestamps differ by > 60s.
Always verify the Coasty-Signature header before acting on webhook events.
Where this beats brittle automation
Purely selector-based bots break when UI changes and need constant maintenance. A computer use agent navigates like a human, adapting to layout shifts, dynamic elements, and popups. By verifying webhooks with HMAC, you guarantee that each status update comes from Coasty and not a forged request, keeping your agent workflows trustworthy even when the UI evolves.
Use HMAC verification to secure your computer use API integrations. Explore full docs, keys, and workflows at https://coasty.ai/developers to start building reliable agent pipelines.