Class WebhookReceiver

Namespace

Livekit.Server.Sdk.Dotnet

Assembly

LivekitApi.dll

Receives the webhook events LiveKit posts: verifies the token of the Authorization header and the SHA-256 of the body, then parses the WebhookEvent.

public class WebhookReceiver : TokenVerifier

Inheritance

object

TokenVerifier

WebhookReceiver

Inherited Members

TokenVerifier.Verify(string)

object.Equals(object)

object.Equals(object, object)

object.GetHashCode()

object.GetType()

object.MemberwiseClone()

object.ReferenceEquals(object, object)

object.ToString()

Examples

var receiver = new WebhookReceiver("api-key", "api-secret");

// ASP.NET Core minimal API. Pass the raw body: LiveKit signs its SHA-256.
app.MapPost("/livekit/webhook", async (HttpRequest request) =>
{
    using var body = new MemoryStream();
    await request.Body.CopyToAsync(body);

    WebhookEvent webhookEvent = receiver.Receive(
        body.ToArray(),
        request.Headers.Authorization.ToString()
    );
    Console.WriteLine($"{webhookEvent.Event} in room {webhookEvent.Room?.Name}");
    return Results.Ok();
});

Constructors

WebhookReceiver(string, string)

Creates a receiver for webhooks signed with the given API key and secret.

public WebhookReceiver(string apiKey = null, string apiSecret = null)

Parameters

apiKey string

API key; the LIVEKIT_API_KEY environment variable when omitted.

apiSecret string

API secret, at least 32 bytes long; the LIVEKIT_API_SECRET environment variable when omitted.

Exceptions

ArgumentException

The key or the secret is missing, or the secret is shorter than 32 bytes.

WebhookReceiver(string, string, TimeSpan?)

Creates a receiver with a custom clock tolerance for the token lifetime.

public WebhookReceiver(string apiKey, string apiSecret, TimeSpan? leeway)

Parameters

apiKey string

API key; the LIVEKIT_API_KEY environment variable when null.

apiSecret string

API secret, at least 32 bytes long; the LIVEKIT_API_SECRET environment variable when null.

leeway TimeSpan?

Clock tolerance applied to the token lifetime; DefaultLeeway when null.

Exceptions

ArgumentException

The key or the secret is missing, or the secret is shorter than 32 bytes.

Methods

Receive(byte[], string, bool, bool)

Verifies a webhook request and parses its event, from the raw bytes of the body, which is what LiveKit signs. Prefer this overload.

public WebhookEvent Receive(byte[] body, string authHeader = null, bool skipAuth = false, bool ignoreUnknownFields = true)

Parameters

body byte[]

The raw bytes of the posted body.

authHeader string

Value of the Authorization header of the request.

skipAuth bool

True to skip the token and SHA-256 checks.

ignoreUnknownFields bool

True to ignore the fields this version of the SDK does not know, so events from newer servers still parse.

Returns

WebhookEvent

The decoded event.

Exceptions

ArgumentNullException

body is null.

Exception

The header is empty, or the SHA-256 of the body does not match the token.

SecurityTokenException

The token has a wrong signature or issuer, or is expired.

ArgumentException

The header is not a well-formed JWT (SecurityTokenMalformedException).

InvalidJsonException

The body is not valid JSON.

InvalidProtocolBufferException

The body is not a webhook event, or has unknown fields while ignoreUnknownFields is false.

Receive(string, string, bool, bool)

Verifies a webhook request and parses its event, from the body as a string. The text is encoded as UTF-8 again to check its SHA-256, so it must be exactly what LiveKit posted; the Receive(byte[], string, bool, bool) overload avoids that conversion.

public WebhookEvent Receive(string body, string authHeader = null, bool skipAuth = false, bool ignoreUnknownFields = true)

Parameters

body string

The posted body, as text.

authHeader string

Value of the Authorization header of the request.

skipAuth bool

True to skip the token and SHA-256 checks.

ignoreUnknownFields bool

True to ignore the fields this version of the SDK does not know, so events from newer servers still parse.

Returns

WebhookEvent

The decoded event.

Exceptions

ArgumentNullException

body is null.

Exception

The header is empty, or the SHA-256 of the body does not match the token.

SecurityTokenException

The token has a wrong signature or issuer, or is expired.

ArgumentException

The header is not a well-formed JWT (SecurityTokenMalformedException).

InvalidJsonException

The body is not valid JSON.

InvalidProtocolBufferException

The body is not a webhook event, or has unknown fields while ignoreUnknownFields is false.