Bunny Stream Webhooks Skill

When to Use This Skill

• Setting up Bunny Stream webhook handlers
• How do I verify Bunny Stream webhook signatures?
• Debugging X-BunnyStream-Signature verification failures
• Handling video state changes (encoding finished, encoding failed)
• Reacting to Status 3 (Finished), Status 5 (Failed), captions, or title/description events

Verification (core)

Bunny Stream signs the exact raw request body with HMAC-SHA256, keyed on your video library's Read-Only API key, and sends the digest as lowercase hex in the X-BunnyStream-Signature header. Verify against the unparsed raw body (do NOT re-serialize the JSON — whitespace or key-order changes break the digest) and compare timing-safe.

This is a custom scheme, not Standard Webhooks (no webhook-id / webhook-timestamp / webhook-signature). It is also distinct from Bunny's general-platform webhooks (HMAC-SHA1, x-bunny-signature) — Stream uses SHA-256 and X-BunnyStream-Signature. There is no official SDK, so verify manually.

Node:

const crypto = require('crypto');

function verifyBunnyStream(rawBody, signatureHeader, secret) {
  if (!signatureHeader) return false;
  const expected = crypto.createHmac('sha256', secret).update(rawBody).digest('hex');
  try {
    return crypto.timingSafeEqual(
      Buffer.from(signatureHeader, 'hex'),
      Buffer.from(expected, 'hex')
    );
  } catch {
    return false; // malformed hex / length mismatch
  }
}

Python:

import hmac, hashlib

def verify_bunny_stream(raw_body: bytes, signature_header: str, secret: str) -> bool:
    if not signature_header:
        return False
    expected = hmac.new(secret.encode(), raw_body, hashlib.sha256).hexdigest()
    return hmac.compare_digest(signature_header, expected)

For complete handlers with route wiring, event dispatch, and tests, see:

• examples/express/
• examples/nextjs/
• examples/fastapi/

The Payload Is Thin — Fetch Back

The callback body carries only three fields:

{ "VideoLibraryId": 12345, "VideoGuid": "0a1b2c3d-...", "Status": 3 }

There is no title, duration, or resolution in the payload. When you need full metadata, call the Stream API GET /library/{libraryId}/videos/{videoGuid} with your (read-write) AccessKey, using VideoGuid from the webhook. Verify the signature before making any fetch-back call.

Status Codes (the event type lives in Status)

For the full event reference, see Bunny Stream Webhooks.

Important Headers

The -Version and -Algorithm headers were observed in a single fetch only and are unconfirmed — they may or may not be present. Do not rely on them; verify solely against X-BunnyStream-Signature.

Environment Variables

# The signing secret IS your video library's Read-Only API key
BUNNY_STREAM_WEBHOOK_SECRET=your_library_read_only_api_key

Local Development

# Start tunnel (no account needed)
npx hookdeck-cli listen 3000 bunny-stream --path /webhooks/bunny-stream

Reference Materials

• references/overview.md - Bunny Stream webhook concepts, Status enum, payload
• references/setup.md - Configure the webhook URL per video library
• references/verification.md - Signature verification details and gotchas