Signed Vast.ai Notification Receiver

Overview

Vast.ai notifications are signed, at-least-once deliveries. Verify the exact raw body before JSON parsing, reject stale timestamps, deduplicate by stable event ID, enqueue durably, and return success only after acceptance.

Prerequisites

• Full subscription keys such as client:low_credit or client:outbid
• Public HTTPS endpoint without redirects or private-address resolution
• Webhook secret store, five-minute replay window, durable queue, and event ledger

Instructions

Step 1: Create a bounded subscription

Discover valid notification types and subscribe only the required full client or host keys. Respect the four-webhook-per-user limit and retain context-specific webhooks when short slugs overlap.

Step 2: Store the one-time secret