Verify Callback Requests with Basic Auth or Extra Metadata

Deepgram no longer supports the dg-token header for verifying callbacks. If your server checks it, switch to Basic Auth by putting credentials in the callback URL and rejecting requests without the expected credentials.

Basic Auth is required for Text-to-Speech and Text Intelligence callbacks, and recommended for Speech-to-Text.

Speech-to-Text also lets you send a random secret through Extra Metadata. Deepgram returns it in metadata.extra.callback_secret; reject callbacks where it's missing or doesn't match. Each key-value pair is limited to 2048 characters, and values with spaces or special characters need URL encoding.