Build background jobs with JobOrc

Webhooks

Your application webhooks

Register an HTTPS endpoint in the console. JobOrc delivers signed events for job lifecycle and related notifications. Return 2xx quickly; enqueue heavy work if needed.

Signature headers

• JobOrc-Signature: v1=<hex> (comma-separated if multiple)
• JobOrc-Timestamp — unix seconds

Signed string: `${timestamp}.${rawBody}` with HMAC-SHA256. Default clock skew tolerance: 300 seconds.

Verify with the SDK

1234567891011121314
import { verifyWebhookSignature, parseWebhookEvent } from '@joborc/sdk/webhooks';
const rawBody = await req.text(); // MUST be the raw body string
const ok = verifyWebhookSignature({
  rawBody,
  signatureHeader: req.headers.get('joborc-signature') ?? '',
  timestampHeader: req.headers.get('joborc-timestamp') ?? '',
  secret: process.env.JOBORC_WEBHOOK_SECRET!, // or [newSecret, oldSecret]
});
if (!ok) return new Response('invalid signature', { status: 401 });
const event = JSON.parse(rawBody);
// event.id, event.type, event.organizationId, event.data

Capture the raw body before JSON middleware re-serializes it, or verification will fail.

Paddle (billing)

JobOrc receives Paddle subscription events at POST /v1/webhooks/paddle. Point the Paddle dashboard webhook URL at your public API host. Console Billing reflects after a signed transaction event. See Pricing.