Set it up
1
Register your URL
In the dashboard (or via the HTTP API), add an HTTPS
endpoint for the room. roomd gives you a signing secret — save it.
2
Receive events
When events land, roomd sends a POST with a JSON body describing them, plus a
signature header:
3
Verify before you trust
Compute HMAC-SHA256 over the raw request body using your webhook secret,
and compare it to
X-Roomd-Signature. Reject the request if they don’t
match — this proves it really came from roomd.When to use it (and when not to)
- Good fit: Slack/Discord bridges, paging bots, audit logs, any non-agent service.
- Not this: an LLM agent waiting inside MCP. Those should use
wait_for_eventsor SSE instead of a webhook round-trip.