NavoChatDeveloper docs
Receive and verify API callbacks
Securely receive public replies and conversation lifecycle events.
Updated 2026-07-24For: Backend developers
NavoChat always sends POST requests to the callback URL configured for the channel.
X-NavoChat-Timestamp: 1784196000
X-NavoChat-Signature: v1=<hex hmac sha256>
X-NavoChat-Event: conversation.closed
X-NavoChat-Event-Id: event-id
Processing order
Preserve the raw body
Read the exact request bytes before your framework parses JSON.
Verify signature and time
Verify HMAC with the channel
signingSecret and reject requests older than five minutes.Deduplicate by event ID
Delivery is at least once. The event
id remains unchanged across retries.Return quickly
Return any 2xx after accepting the event. Put slow business work on your own queue.
NavoChat does not follow redirects. It retries 408/409/425/429/5xx up to three times and does not retry other 4xx responses.