Webhooks

Events

Payload

{
  "event": "generation.completed",
  "data": {
    "id": 1284,
    "status": "completed",
    "type": "icon",
    "result_url": "https://storage.museai.xeycompany.com/icon_abc.png",
    "credits_used": 1,
    "credits_remaining": 499
  }
}

Signature verification

Signatures use HMAC-SHA256 with your webhook secret, sent in the X-MuseAI-Signature header. Verify before trusting any webhook payload.

// Node.js
const crypto = require("crypto");
const sig = crypto
  .createHmac("sha256", process.env.MUSEAI_WEBHOOK_SECRET)
  .update(rawBody)
  .digest("hex");
if (sig !== header["x-museai-signature"]) throw new Error("Invalid signature");