AssemblyAI Authenticated Webhook Processing

Overview

Process callbacks as authenticated, repeatable delivery attempts. Keep acknowledgment, content retrieval, persistence, replay, credentials, and deletion separately governed.

Prerequisites

• The target repository or integration path and the requested operator outcome.
• The AssemblyAI project, environment, region, data classification, and accountable owner.
• Current first-party documentation plus credentials only for a narrowly approved live check.

Current Contract

Pre-recorded callbacks carry transcript ID and status; fetch the full transcript separately. Streaming callbacks after termination can carry finalized turns. AssemblyAI documents a 10-second acknowledgment window and up to 10 attempts when no 2xx is received; a 4xx stops retries. Verify the configured custom auth header.

Authentication

For live work, inject ASSEMBLYAI_API_KEY from an approved secret manager and send the raw value only in the AssemblyAI Authorization header to the configured first-party host. Never print, commit, place in a URL, or expose it to an untrusted client. Callback secrets and temporary streaming tokens are separate credentials.