Inbound webhooks (Replicate) — Hypery Docs

Summary

When you use Replicate through Hypery with REPLICATE_WEBHOOK_URL pointing at this deployment, Replicate sends completion events to POST /api/webhooks/replicate. The gateway verifies each request using Replicate’s signing secret (whsec_...) per Replicate webhook verification, then finalizes billing idempotently.

Endpoint


URL	`POST /api/webhooks/replicate` (full URL is your deployment origin + path)
Caller	Replicate (not your app’s users)

Input (HTTP)

Replicate sends a JSON body (prediction id, status, metrics, etc.). Verification uses these headers (do not strip or rewrite the raw body before verifying):

webhook-id
webhook-timestamp
webhook-signature (space-delimited v1,<base64> entries)

Output (JSON)

Example success:

{
  "received": true,
  "predictionId": "abc123",
  "status": "succeeded",
  "charged": true
}

Duplicate delivery (same webhook-id):

{
  "received": true,
  "duplicate": true,
  "predictionId": "abc123"
}

Environment variables

Variable	Required (production)	Description
`REPLICATE_WEBHOOK_SECRET`	Yes	Signing key from Replicate (`whsec_...`).
`ALLOW_UNVERIFIED_REPLICATE_WEBHOOK`	No	`true` only in local dev if you cannot configure the secret; never in production.

# From Replicate: GET https://api.replicate.com/v1/webhooks/default/secret
export REPLICATE_WEBHOOK_SECRET="whsec_..."

These protect model sync and migration routes (not public API keys):

Variable	Production
`CRON_SECRET`	Set; Vercel cron sends `Authorization: Bearer <CRON_SECRET>`.
`ADMIN_TOKEN`	Optional second bearer secret for manual invokes.
`ALLOW_UNAUTHENTICATED_ADMIN_ROUTES`	`true` only for local dev; never in production.

Code examples (verifying manually)

# Health check only — will fail signature without real Replicate headers
curl -sS -X POST "https://YOUR_DEPLOYMENT/api/webhooks/replicate" \
  -H "Content-Type: application/json" \
  -d '{"id":"test"}'