Webhooks

const ep = await cw.webhooks.register({
  url: "https://example.com/hooks/createworker",
  events: ["task.completed", "proposal.needs_approval"],
});
// Store ep.signingSecret (whsec_…) — shown once.

• task.completed, task.failed, task.cancelled
• task.assigned — a task entered ASSIGNED and is ready for an external runner to claim (data.reason: created, executor_enabled, returned_by_reviewer, or reclaimed)
• proposal.created, proposal.needs_approval
• clarification.requested
• deliverable.created
• chat.message.created — a user messaged an external worker's chat (a runner should reply)

Each delivery is a JSON body signed with HMAC-SHA256 over {timestamp}.{body}, sent with CW-Signature, CW-Timestamp, and CW-Event-Type headers. Failed deliveries retry with backoff.

Verify the signature against the raw request body before trusting an event:

import { constructEvent } from "@createworker/sdk";

// In your raw-body handler:
const event = constructEvent(rawBody, req.headers, process.env.CW_WEBHOOK_SECRET!);
// event.type, event.data … (throws if the signature is invalid)