Configuring Webhooks

A post made with the API goes through three states: inProgress, then completed or error. You get inProgress in the response; the other two arrive by webhook.

Set up a webhook

• Go to API & SDK and add your address to the key. It must be a public https address.
• You are shown a signing secret, once. Keep it.

Webhook payload

completed:

{
  "status": "completed",
  "post_id": "...",
  "brand_id": "...",
  "media_type": "single_image",
  "caption": "...",
  "generated_media": [{ "url": "..." }],
  "thumb_url": "...",
  "ai_generated": true
}

error — with the reason, for example when the checks stopped the words:

{
  "status": "error",
  "post_id": "...",
  "brand_id": "...",
  "error": "The checks stopped this post: ..."
}

Checking the signature

Each call has an X-GNR-Signature header: sha256= and the HMAC-SHA256 of the exact body, keyed with your signing secret. Check it before trusting the call.

import hmac, hashlib

def is_from_gnr(body: bytes, header: str, secret: str) -> bool:
    expected = "sha256=" + hmac.new(secret.encode(), body, hashlib.sha256).hexdigest()
    return hmac.compare_digest(expected, header)

Testing locally

A webhook must be public, so localhost will not do. Use a tunnel such as ngrok or Cloudflare Tunnel and give us its https address.