Verify Computer Use API Webhooks with HMAC Signatures
Webhooks let you know when a task run or workflow finishes. The Coasty computer use API signs webhook payloads with HMAC. You must verify the signature header before trusting the request body. This prevents spoofed callbacks and ensures your system only processes valid events.
How webhook verification works
The API sends a request to your webhook_url with header Coasty-Signature: t=unix,v1=hex. The unix timestamp is the request time in seconds. The hex string is an HMAC-SHA256 of the raw request body using your API key as a secret. Your server must recompute the HMAC and compare it to the header value. If they match, the payload is authentic. The header also lets you detect replay attacks by checking that the timestamp is within a reasonable window of your server time.
Webhook response states
curl -X POST https://coasty.ai/v1/runs \ -H "X-API-Key: $COASTY_API_KEY" \ -H "Content-Type: application/json" \ -d '{ "machine_id": "m-12345", "task": "open chrome and navigate to coasty.ai", "cua_version": "v3", "max_steps": 50, "webhook_url": "https://your-server.com/hooks/coasty" }'
- ●queued: the run is waiting for resources
- ●running: the agent is executing steps
- ●awaiting_human: the agent paused for approval
- ●succeeded: all steps passed
- ●failed: one or more steps failed
- ●cancelled: the run was stopped
- ●timed_out: the deadline_seconds expired
Always verify the Coasty-Signature header before acting on webhook data.
Where this beats brittle automation
API-only tools rely on stable selectors or fixed endpoints. A small UI change breaks them. With the Coasty computer use API you drive real desktops and browsers like a human. The agent sees the screen, interprets text, and clicks buttons. Webhooks confirm when the task finishes, so you can orchestrate workflows without polling. The HMAC signature guarantees that only Coasty sends those callbacks, reducing false positives and security risks.
Add webhook verification to your Coasty integration to trust every callback. Monitor task runs and workflows in real time. Get your key at https://coasty.ai/developers .