Meeting webhooks for bookings, calls and AI summaries.

Which events can I receive?

Five events cover a booking from start to finish. Pick any of them per endpoint; each delivery names its event in the Meeto-Event header and the event field.

Subscribe at least one endpoint to booking.created. Later events of a booking are sent only if its creation went out to some endpoint. They go to the endpoints that received booking.created; when none of your endpoints holds that delivery, for example after the log was cleaned up, they go to every endpoint subscribed to the event. A booking made before you added any endpoint stays silent, also when it is cancelled, ends or gets a summary. Summaries need a host on Pro or Team; see AI meeting summaries.

What does a webhook payload look like?

Every event has the same shape, so one parser handles all five. Times are UTC in RFC 3339; timezone is the host's working time zone for display.

POST /hooks/meeto HTTP/1.1
Content-Type: application/json
User-Agent: Meeto-Webhooks/1.0
Meeto-Event: booking.created
Meeto-Webhook-Id: <endpoint id>
Meeto-Delivery-Id: 1421
Meeto-Signature: t=1805702400,v1=5f0c…e9a1

{
  "event": "booking.created",
  "createdAt": "2027-03-20T09:14:03Z",
  "occurredAt": "2027-03-20T09:14:03Z",
  "bookingUid": "bk_4f1c9a2b7e3d8054a1cb62d7f9",
  "ref": "deal-4821",
  "tracking": { "ref": "deal-4821", "utm_source": "newsletter" },
  "workspace": null,
  "host": { "userId": "<user id>", "handle": "anna", "name": "Anna Example", "email": "anna@example.com" },
  "guest": { "name": "Sam Guest", "email": "sam@example.com", "company": "Acme" },
  "eventType": { "id": "<type id>", "title": "Intro call", "slug": "intro", "durationMin": 30 },
  "startsAt": "2027-03-22T10:00:00Z",
  "endsAt": "2027-03-22T10:30:00Z",
  "timezone": "Europe/Berlin",
  "meetingUrl": "https://meeto.me/<room>?k=<room access key>",
  "status": "confirmed",
  "answers": [{ "label": "Company", "answer": "Acme" }]
}

// meeting.ended adds:
"meeting": {
  "sessionId": "<call session id>",
  "startedAt": "2027-03-22T10:01:12Z",
  "endedAt": "2027-03-22T10:34:40Z",
  "durationSec": 2008,
  "peakParticipants": 2
}

// recap.ready adds:
"recap": {
  "url": "https://meeto.me/m/<page token>",
  "title": "Intro call",
  "recordings": [{ "url": "https://meeto.me/api/m/<page token>/file/<id>/video", "durationSec": 1990 }]
}

How do I verify the signature?

Compute HMAC-SHA256 with your endpoint secret (whsec_…) over "<t>.<raw body>" and compare it with v1 from Meeto-Signature in constant time. Use the raw request bytes, not re-serialized JSON, and reject a t more than five minutes away from your clock to block replays.

import crypto from "node:crypto";
import express from "express";

const secret = process.env.MEETO_WEBHOOK_SECRET; // whsec_…

function verifyMeetoSignature(rawBody, header, toleranceSec = 300) {
  const parts = Object.fromEntries(
    (header ?? "").split(",").map((part) => part.split("=", 2)),
  );
  const t = Number(parts.t);
  if (!Number.isInteger(t) || !parts.v1) return false;
  if (Math.abs(Date.now() / 1000 - t) > toleranceSec) return false;
  const expected = crypto
    .createHmac("sha256", secret)
    .update(`${t}.`)
    .update(rawBody)
    .digest();
  const received = Buffer.from(parts.v1, "hex");
  return received.length === expected.length && crypto.timingSafeEqual(received, expected);
}

const app = express();

// express.raw keeps the exact bytes Meeto signed; do not parse JSON first.
app.post("/hooks/meeto", express.raw({ type: "application/json" }), (req, res) => {
  if (!verifyMeetoSignature(req.body, req.get("Meeto-Signature"))) {
    return res.sendStatus(401);
  }
  const deliveryId = req.get("Meeto-Delivery-Id"); // the same on every retry
  const event = JSON.parse(req.body.toString("utf8"));
  console.log(deliveryId, event.event, event.bookingUid);
  res.sendStatus(200); // answer fast, do slow work in your own queue
});

app.listen(3000);

import hashlib, hmac, time

def verify_meeto_signature(raw_body: bytes, header: str, secret: str, tolerance: int = 300) -> bool:
    parts = dict(p.split("=", 1) for p in header.split(",") if "=" in p)
    t, v1 = parts.get("t", ""), parts.get("v1", "")
    if not t.isdigit() or abs(time.time() - int(t)) > tolerance:
        return False
    expected = hmac.new(secret.encode(), f"{t}.".encode() + raw_body, hashlib.sha256).hexdigest()
    return hmac.compare_digest(expected.encode(), v1.encode())

Before real traffic, press Send test on the endpoint. It sends a signed {"event":"test","createdAt":"…"} with Meeto-Event: test and a Meeto-Delivery-Id starting with test-, and shows your server's answer at once. The button allows five tests, then one a minute.

How do retries and ordering work?

Answer with any 2xx to accept a delivery. Meeto waits 10 seconds to connect and 15 seconds for your answer, does not follow redirects (a 3xx counts as a failure) and retries everything else on a fixed schedule.

Retries send the exact same body and the same Meeto-Delivery-Id. Deliveries to one endpoint leave in order, but a delivery that has failed three times stops holding back the ones behind it, so order your own records by occurredAt. Reply 2xx to event names you do not know; new ones may be added.

Delivery log and redelivery

Endpoint URLs must be public https addresses without credentials in them; each endpoint listens to at least one event. A personal secret is shown once, when you create the endpoint. New secret replaces it immediately, and the old one stops verifying.

Personal and workspace webhooks compared

A Team workspace can send events to its own endpoints, managed by the owner and admins on the team webhooks screen. Every paid seat also includes personal webhooks, because a seat gives full Pro.

After rotating a workspace secret, put the new one into your receiver promptly: deliveries signed with it fail verification on a receiver that knows only the old secret, and they come back on the retry schedule above. A workspace that stops paying pauses its endpoints; events wait in the queue, up to 30 days, and go out after payment. For the call itself, see how Meeto handles security.

Frequently asked questions

Explore more with Meeto