Verify Computer Use API Webhooks with HMAC Signatures
When you POST to /v1/runs or /v1/workflows, Coasty returns a webhook_url you can configure to receive events about task runs. You need to verify each payload is actually from Coasty to avoid replay or tampering attacks. The platform signs every webhook using HMAC-SHA256 and sends the signature header Coasty-Signature: t=unix,v1=hex. You decode that header, compute your own HMAC, and compare the hex digest. If they match, the payload is authentic. This works for task run states queued, running, awaiting_human, succeeded, failed, cancelled, and timed_out.
How it works
Coasty sends webhook POST requests with the following pieces of data. You must validate the signature header and the payload body together. The signature header format is Coasty-Signature: t=unix,v1=hex where t is the Unix timestamp of the request and v1 is the HMAC hex digest. The body contains the JSON event payload. For task runs, this includes the run ID, state, and any metadata. You compute HMAC-SHA256 of the raw request body using your API key as the secret key. You compare your computed hex digest with the v1 value from the header. If they match, the event is valid. If they differ or the timestamp is off by more than a few minutes, reject the request.
curl -X POST https://your-server.com/webhook -H "Content-Type: application/json" -d '{"run_id":"abc123","state":"succeeded"}'Webhook signature header format
- ●Header name: Coasty-Signature
- ●Format: t=unix,v1=hex
- ●t: Unix timestamp in seconds
- ●v1: HMAC-SHA256 hex digest of the raw request body
- ●Compute your HMAC using your API key as the secret key
Compute HMAC-SHA256 of the raw request body using your API key, then compare the hex digest with the v1 value in the Coasty-Signature header.
Where this beats brittle automation
When you build a computer use agent, you rely on the fact that the agent can see the screen and act like a human. Webhooks give you a reliable way to know when the agent finishes or when it needs human approval. Using HMAC signatures ensures that an attacker cannot spoof success or failure events. This is especially important when you integrate with downstream systems or update databases based on run state. Unlike brittle selectors or API-only tools that depend on exact element matches, Coasty’s computer use API gives you a high-fidelity view of the desktop and lets you verify events through cryptographic signatures.
Next, build a task run that posts to /v1/runs with a webhook_url, then implement webhook validation on your server. Get your API key at https://coasty.ai/developers and start building secure computer use agents.