> ## Documentation Index
> Fetch the complete documentation index at: https://developer.sandbox.co.in/llms.txt
> Use this file to discover all available pages before exploring further.

# Webhooks

> Receive real-time notifications when events occur in your Sandbox account.

webhooks send real-time notifications to your app when specific events occur. When you subscribe to an event, Sandbox delivers the payload directly to your endpoint.

For example, subscribing to `tds.206-ab.done` notifies you each time a 206AB job completes.

## Configure webhooks

Set up your webhook url, subscribed events, and secret key in the Sandbox Console. See [How to Configure Webhooks](https://help.sandbox.co.in/portal/en/kb/articles/configure-a-webhook) for step-by-step instructions.

## Validate webhook signatures

When you configure a webhook secret, Sandbox generates a hash signature for each payload. Validate this signature to ensure the webhook is authentic.

Sandbox includes the signature in the `x-sandbox-signature` header using a base64-encoded hash-based message authentication code (HMAC) with SHA-256.

```javascript JavaScript theme={null}
const crypto = require('crypto');

function validateWebhook(payload, signature, secret) {
  const expectedSignature = crypto
    .createHmac('sha256', secret)
    .update(JSON.stringify(payload))
    .digest('base64');
  
  return signature === expectedSignature;
}

// In your webhook handler
app.post('/webhook', (req, res) => {
  const signature = req.headers['x-sandbox-signature'];
  const isValid = validateWebhook(req.body, signature, WEBHOOK_SECRET);
  
  if (!isValid) {
    return res.status(401).send('Invalid signature');
  }
  
  // Process webhook
  res.status(200).send('OK');
});
```

```python Python theme={null}
import hmac
import hashlib
import base64
import json

def validate_webhook(payload, signature, secret):
    expected_signature = base64.b64encode(
        hmac.new(
            secret.encode(),
            json.dumps(payload).encode(),
            hashlib.sha256
        ).digest()
    ).decode()
    
    return signature == expected_signature

# In your webhook handler
@app.route('/webhook', methods=['POST'])
def handle_webhook():
    signature = request.headers.get('x-sandbox-signature')
    is_valid = validate_webhook(request.json, signature, WEBHOOK_SECRET)
    
    if not is_valid:
        return 'Invalid signature', 401
    
    # Process webhook
    return 'OK', 200
```

> [!WARNING]
>
> Always validate webhook signatures before processing the payload to prevent unauthorized requests.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.