Recipe 06 — Subscribe to webhooks (verify HMAC + dedupe)

Status: ⏸ Coming M6+ TZ reference: TZ-10 §9.11 (webhook tiers), TZ-10 §26.2 row 6

Why deferred

Webhook subscription infrastructure (subscriptions table, signing keys, delivery worker, DLQ) is scheduled for M6+ Public Beta. The Day-0 API ships with outbox-pull only; consumers poll the relevant GET endpoints (e.g. client.swap.get(...)) or use SSE/WS streaming (recipe 08).

When to revisit

After master-plan gate t10-webhook-tiers lands (TZ-10 §9.11) — tracked in the M6 Public Beta milestone. At that point this recipe will ship with runnable Python + TS examples covering:

• Subscribing to event types via POST /v1/webhooks
• Verifying the X-CryptoAI-Signature HMAC header
• Dedupe via X-CryptoAI-Delivery-Id
• DLQ inspection (see recipe 23)