Webhooks - Porn Factory AI API

Pass a public HTTPS webhook_url when you submit a generation. Porn Factory AI delivers generation.completed or generation.failed after the request reaches a terminal state.

{
  "webhook_url": "https://example.com/webhooks/pornfactoryai"
}

Webhook endpoints must resolve to a public network address. Redirects, private IP ranges, loopback targets, and local hostnames are rejected.

Delivery headers

X-PF-Event-Id: stable event ID for deduplication
X-PF-Timestamp: Unix timestamp used in the signature
X-PF-Signature: sha256= followed by a hexadecimal HMAC digest

Verify the signature

The signed value is {timestamp}.{raw_body}. Use the whsec_ secret shown when the API key was created.

import crypto from "node:crypto";

export function verifyWebhook({ body, signature, timestamp, secret }) {
  const age = Math.abs(Date.now() / 1000 - Number(timestamp));
  if (!Number.isFinite(age) || age > 300) return false;

  const expected = `sha256=${crypto
    .createHmac("sha256", secret)
    .update(`${timestamp}.${body}`)
    .digest("hex")}`;

  const left = Buffer.from(signature);
  const right = Buffer.from(expected);
  return left.length === right.length && crypto.timingSafeEqual(left, right);
}

Verify the raw body before parsing JSON. Reject timestamps older than five minutes and deduplicate by X-PF-Event-Id.

Retry behavior

Delivery is at least once. Failed deliveries are retried with exponential backoff for up to eight attempts. Return a 2xx response only after the event has been durably recorded. Your handler must be idempotent.

⌘I