Skip to main content

fathom-webhook

Public webhook receiver for Fathom. Supabase JWT verification is disabled at the gateway for this function — Fathom calls it directly, and HMAC verification happens in code instead.

Required headers​

  • webhook-id
  • webhook-timestamp
  • webhook-signature

The signature payload is <webhook-id>.<webhook-timestamp>.<raw-body>. The function rejects stale timestamps and replayed successful webhook ids, and returns 503 until FATHOM_WEBHOOK_SECRET is set, 401 for a missing/invalid signature.

Registering the webhook is a one-shot call to fathom-sync: { "registerWebhook": true } creates it and returns the whsec_ secret once — store it immediately, it is not retrievable again.

Where the code lives​

  • sable-agents-demo/supabase/functions/fathom-webhook/index.ts
  • sable-agents-demo/supabase/functions/_shared/fathom.js — verifyFathomSignature, reused verbatim by email-webhook