> ## Documentation Index
> Fetch the complete documentation index at: https://docs.opennous.cloud/llms.txt
> Use this file to discover all available pages before exploring further.

# Webhook Overview

> Every inbound webhook endpoint Nous exposes — URLs, payloads, and HMAC secrets.

## How webhooks work

Nous's worker exposes a webhook server at `https://api.yourdomain.com/inbound/`. Each source gets its own path with your workspace ID embedded in the URL.

```text theme={null}
https://api.yourdomain.com/inbound/<source>/<workspaceId>
```

All handlers return `{ "ok": true }` immediately — retries won't cause duplicate activities because every event is deduplicated by `external_id`.

<Note>
  LinkedIn webhooks are configured differently — they go through Unipile using a query-param URL. See the [LinkedIn provider page](/providers/linkedin) for exact setup.
</Note>

## Available endpoints

| Source                             | Endpoint                          | Creates contacts? |
| ---------------------------------- | --------------------------------- | ----------------- |
| [Instantly](/webhooks/instantly)   | `/inbound/instantly/:workspaceId` | Yes               |
| [Fireflies](/webhooks/fireflies)   | `/inbound/fireflies/:workspaceId` | No                |
| [Fathom](/webhooks/fathom)         | `/inbound/fathom/:workspaceId`    | No                |
| [RB2B](/webhooks/rb2b)             | `/inbound/rb2b/:workspaceId`      | Yes               |
| [Calendly](/webhooks/calendly)     | `/inbound/calendly/:workspaceId`  | Yes               |
| [Custom capture](/webhooks/custom) | `/api/v1/capture` (API key auth)  | No                |

## HMAC verification

Set a shared secret for each source in `nous.env`. Nous validates the signature header using `HMAC-SHA256`.

```bash theme={null}
INSTANTLY_WEBHOOK_SECRET=your-secret
CALENDLY_WEBHOOK_SECRET=your-secret
FIREFLIES_WEBHOOK_SECRET=your-secret
FATHOM_WEBHOOK_SECRET=whsec_your-svix-secret
RB2B_WEBHOOK_SECRET=your-secret
```

<Note>
  Fathom uses svix-based signing (`webhook-signature` header) with timestamp tolerance. All other sources use standard `x-nous-signature: sha256=hmac`.
</Note>

If a secret is **not set**, the signature check is skipped — fine for local dev, set secrets in production.

## Finding your workspace ID

Your workspace ID is a UUID visible in **Settings → Workspace**. It's also returned in all API responses under `workspace_id`.