Verify Callback Requests with Basic Auth or Extra Metadata
By Steven Van ·
Deepgram callbacks no longer support dg-token verification; use Basic Auth for STT, TTS and Text Intelligence, or an Extra Metadata secret for STT.
Callback servers that check the dg-token header to confirm a request came from Deepgram need to change. Deepgram has dropped support for that method, and recommends Basic Auth instead.
Basic Auth for all callbacks
Credentials go in the callback URL, for example https://username:password@example.com/callback. Deepgram includes them when it sends results to the callback server, which can then reject any request without the expected credentials. This is the only option for Text-to-Speech (/v1/speak) and Text Intelligence (/v1/read), and it is the recommended one for Speech-to-Text (/v1/listen).
Secret in Extra Metadata (Speech-to-Text only)
Speech-to-Text requests can instead carry a random secret as an extra key-value pair:
https://api.deepgram.com/v1/listen?callback=https://example.com/callback&extra=callback_secret:YOUR_SECRET_VALUE
Deepgram returns the value in metadata.extra.callback_secret in the callback request body. The server should reject any callback where the value is missing or does not match.
Extra Metadata values are limited to 2048 characters per key-value pair. Values with spaces or special characters need to be URL encoded.