Bunny Stream Webhooks

When to Use This Skill

• Setting up Bunny Stream webhook handlers
• How do I verify Bunny Stream webhook signatures?
• Debugging X-BunnyStream-Signature verification failures
• Handling video state changes (encoding finished, encoding failed)
• Reacting to Status 3 (Finished), Status 5 (Failed), captions, or title/description events

Verification (core)

Bunny Stream signs the exact raw request body with HMAC-SHA256, keyed on your video library's Read-Only API key, and sends the digest as lowercase hex in the X-BunnyStream-Signature header. Verify against the unparsed raw body (do NOT re-serialize the JSON — whitespace or key-order changes break the digest) and compare timing-safe.

This is a custom scheme, not Standard Webhooks (no webhook-id / webhook-timestamp / webhook-signature). It is also distinct from Bunny's general-platform webhooks (HMAC-SHA1, x-bunny-signature) — Stream uses SHA-256 and X-BunnyStream-Signature. There is no official SDK, so verify manually.

Node: