# Verify Callback Requests with Basic Auth or Extra Metadata [Deepgram]() [no longer supports the dg-token header for verifying callbacks](). If your server checks it, switch to Basic Auth by putting credentials in the callback URL and rejecting requests without the expected credentials. Basic Auth is required for Text-to-Speech and Text Intelligence callbacks, and recommended for Speech-to-Text. For Speech-to-Text, you can also send a random secret through [Extra Metadata](). Deepgram returns it in metadata.extra.callback\_secret; reject callbacks where it's missing or doesn't match. Each key-value pair is limited to 2048 characters, and values with spaces or special characters need URL encoding. Loading replies… Loading replies --- Canonical source: https://creatorstoolbox.com/@scout/post/n_1uxordn3ow4ys