Transloadit

What is Signature Authentication for Notification?

Signature Authentication for Notification lets a backend verify the authenticity and integrity of Notifications sent by Transloadit. Each notification is a form-encoded POST whose transloadit field carries the Assembly Status JSON as a string and whose signature field carries an HMAC of that string computed with the Workspace’s Auth Secret.

Request + files
Processing platform
Results + status
A processing platform accepts an authenticated request, executes a workflow, and returns observable results. This diagram shows platform workflows broadly, not specifically Signature Authentication for Notification.

How Signature Authentication for Notification works

When a processing notification reaches a webhook endpoint, the receiver recomputes the authentication value from the verbatim transloadit form field and compares it with the signature field before trusting the parsed event. Signatures prefixed with an algorithm name in the form algo:signature identify the hash used, while unprefixed values are legacy SHA-1 signatures. Verification protects integrity and origin authentication but does not by itself guarantee that a valid delivery is new, so it is the first stage in a webhook pipeline, ahead of idempotency checks, job lookup, and side effects.

Key facts

  1. The signature covers only the JSON string delivered in the transloadit form field, not the raw HTTP request body, so verification works after ordinary form parsing as long as the field value is hashed verbatim.
  2. A constant-time comparison avoids leaking how much of a supplied signature matched, and malformed encodings should be rejected before any business action occurs.
  3. A valid notification can be delivered more than once during retries; verification must be paired with an idempotency key or recorded event identity to prevent duplicate effects.

When Signature Authentication for Notification matters

Verify every notification before updating records or triggering downstream work: parse the form, compute the HMAC over the exact transloadit field value, and compare it with the supplied signature. Never JSON-parse and re-serialize the payload before verifying, because a re-serialized string will not match the bytes that were signed.

Common use cases for platform workflows

These examples cover platform workflows broadly, not specifically Signature Authentication for Notification.

  • Running repeatable upload, import, processing, AI, storage, and notification pipelines.
  • Tracking long-running media work independently from an application request.
  • Referencing centrally stored credentials by name instead of sending storage secrets with each request.

Working with platform workflows

This guidance covers platform workflows broadly, not just Signature Authentication for Notification.

A client authenticates and submits files or references together with workflow instructions. The platform validates the request, schedules dependent operations, records state transitions, and exposes results through a response, polling endpoint, or notification.

Platform concepts become reliable only when their lifecycle is explicit. Authentication, idempotency, retries, timeouts, observability, quotas, and terminal states should be designed together rather than added after failures occur.

What you gain

  • Reusable workflows separate application intent from processing infrastructure.
  • Stable job identifiers and lifecycle events improve observability and recovery.
  • Managed queues and workers let products scale without embedding every media tool.

What it costs

  • Synchronous responses are simple but keep connections open while long work executes.
  • Aggressive retries improve recovery from transient faults but can duplicate work or overload a dependency.
  • Higher concurrency reduces queue time until resource contention or a downstream limit becomes the bottleneck.

Before production

  1. Define authentication, authorization, idempotency, retries, and terminal error behavior.
  2. Observe queue time, execution time, callbacks, and partial results with stable identifiers.
  3. Exercise malformed, duplicate, interrupted, and unauthorized requests before launch.

Turn media knowledge into a working pipeline

Connect uploads, processing, AI, storage, and delivery through one declarative API — with the encoding stack, scaling, and format churn handled for you.

Try Transloadit for free