How do I validate a callback request?

Due to the infrastructure that Deepgram leverages, there is no set range of IP addresses from which callback requests will originate. This means that you cannot whitelist specific IP addresses to allow access to your internal network. However, there are other methods you can use to validate callback requests and ensure that they are legitimate.

Within your callback URL, you may embed basic username-password authentication credentials in the callback URL, in the format https://username:password@host.example.com.

Additionally, the callback request will contain a header called dg-token which will be set to the API Key Identifier of the API Key used to submit the request.

Another method is to validate callback requests from Deepgram using the request_id. When a transcription job is created, Deepgram returns a unique request_id that identifies the job. We recommend comparing the request_id returned to your server to the request_id in the transcription response received at the callback. By comparing the request_id in the callback request to the request_id returned in the original request, you can ensure that the callback request is legitimate.

If your internal network environment requires you to allow only specific IP addresses to access your network, another method would be to set up a proxy outside of your network to receive Deepgram's callbacks. For example, you can set up a server in a DMZ that proxies Deepgram's callbacks to your internal network. This way, you can whitelist the IP address of the proxy server and allow it to access your internal network while keeping the rest of your network secure.

If you have further security concerns or specific needs, please contact Deepgram's sales department to discuss your options.

Can callback URLs contain an underscore ("_")?

No - if a callback URL contains an underscore, the system will respond with an error like:

"err_code":"Bad Request","err_msg":"Failed to resolve callback."

Last updated 2 years ago