Webhooks
How do I verify that a webhook came from HeyMilo? Webhooks created through the v2 or v4 endpoints are signed with HMAC-SHA256. The create response includes asigning_secret (it starts with whsec_). Each delivery carries an X-HeyMilo-Signature header with a timestamp and signature; recompute the signature with your secret and compare. See Verifying Webhook Signatures.
Can I retrieve or rotate a webhook’s signing secret?
No. The secret is returned once, in the create response, and never appears in get or list responses. If you lose it, delete the webhook and register a new one to get a fresh secret. Each webhook has its own secret.
I registered a webhook before signing existed. Does it have a secret?
No. Older registrations, and any created through the legacy POST /api/webhook/create endpoint, are delivered unsigned. Delete the webhook and re-create it through POST /api/v2/webhooks or POST /api/v4/webhooks to start receiving signed deliveries.
Interviews & results
The transcript shows “Interviewer Sara” but I set a differentinterviewer_name. Why?
“Sara” in the transcript is a fixed display label. It isn’t read from your posting or step configuration, and the AI doesn’t use it. The AI introduces itself with the interviewer_name you set. If you rename your interviewer, update interviewer_name; the change applies to future interviews only, and past transcripts are unchanged.