Webhooks

Register a webhook endpoint and QuickTane will POST a signed JSON payload to your server every time a run reaches a terminal status. This is the recommended way to consume run results at scale.

Setup

1. Add an endpoint URL in your dashboard under Webhooks.
2. Copy the generated signing secret — used to verify deliveries.
3. Subscribe to the events you care about (or all of them).

Events

Payload

Each delivery is a JSON body describing the event, with the run object under data:

{
  "id": "3f1a…",                    // unique event id
  "type": "run.completed",
  "created_at": "2026-07-19T12:00:00+00:00",
  "data": {
    "run_id": 42,
    "status": "completed",
    "language": "python",
    "exit_code": 0,
    "duration_ms": 137,
    "output": "45\n",
    "created_at": "2026-07-19T12:00:00.000000Z"
  }
}

Headers

Verifying signatures

The signature is an HMAC-SHA256 of the raw request body keyed with your signing secret, prefixed with sha256=. Always verify it before trusting a delivery, and always hash the raw bytes — not a re-serialised object.

from quicktane import verify_signature

# in your webhook handler — use the RAW request body
if not verify_signature(raw_body, request.headers["X-QuickTane-Signature"], signing_secret):
    abort(400)

Doing it by hand in any language is a one-liner:

import hmac, hashlib

def verify(raw_body: bytes, header: str, secret: str) -> bool:
    expected = "sha256=" + hmac.new(secret.encode(), raw_body, hashlib.sha256).hexdigest()
    return hmac.compare_digest(expected, header)