Skip to main content
Bind a tool to an inbound webhook behind a verifier and a condition filter. The runtime fires a tool when a signed webhook arrives. A hook binds a topic to a tool; a verifier authenticates each delivery over its raw bytes before the payload is parsed; an optional condition filters which deliveries fire the tool. This guide covers the platform wiring — the hook, the verifier binding, and the filter. Provider-specific signature schemes live in that verifier plugin’s own repository README.

​
Register a hook

A hook names the topic to listen on and the tool to fire. Register it from a HookParams JSON body. Add a condition (a jq expression over the delivery) to fire the tool only on matching deliveries.
List the registered hooks:

​
Bind a verifier to the topic

An inbound webhook door is public — bind a verifier so every delivery on the topic is signature-verified before the tool fires. Name a registered verifier and pass its per-binding config. Verification fails closed: a signature failure rejects the delivery and the tool never runs.
The verifier config never holds a secret value — only the name of the environment variable that holds it, resolved at verify time.
1

Load the verifier

A verifier registers when the manifest imports its module. Load the built-in shared-secret verifier — or a provider verifier package — under lifecycle_modules.
manifest.yml
2

Register the hook

Bind the topic to the tool with tai hooks register.
3

Bind the verifier

Lock the topic’s door with tai hooks set-verifier. Remove a binding with tai hooks delete-verifier.
A topic with no verifier bound accepts unauthenticated deliveries — the door is open. Bind a verifier to any topic reachable from the internet. A body-signature verifier rejects GET delivery, so the raw payload cannot ride the URL unauthenticated.

​
See also