fathom-webhook
Public webhook receiver for Fathom. Supabase JWT verification is disabled at the gateway for this function — Fathom calls it directly, and HMAC verification happens in code instead.
Required headers
webhook-idwebhook-timestampwebhook-signature
The signature payload is <webhook-id>.<webhook-timestamp>.<raw-body>. The function rejects
stale timestamps, and returns 503 until FATHOM_WEBHOOK_SECRET is set, 401 for a
missing/invalid signature and 400 for a body that isn't JSON. A valid delivery answers 202
straight away and is ingested in the background; a redelivery of an id already claimed answers
200 with duplicate: true. See Fathom for the claim rules.
Registering the webhook is a one-shot call to fathom-sync:
{ "registerWebhook": true } creates it and returns the whsec_ secret once — store it
immediately, it is not retrievable again.
Where the code lives
supabase/functions/fathom-webhook/index.tssupabase/functions/_shared/fathom.js—verifyFathomSignature, reused verbatim byemail-webhook