Source type

Twitch Source

Twitch sources receive EventSub webhook notifications, verify Twitch signatures, and answer callback verification challenges.

TWITCHPOST, PUT, PATCH, DELETEEventSub SecretCommunication
Twitch EventSub webhook documentationAll source types
Twitch sends webhook traffic to a FastHook source, FastHook validates the provider contract, records the request, and routes accepted events through connections to destinations.TwitchProviderPOST, PUT, PATCH, DELETEChallengeFastHookSource URLTWITCHProvider credentialchallengeVerify before queue401 on auth failure405 on wrong methodAcceptedRequestverified: trueConnections route the accepted request to destinationsFilters, transformations, retries, replay, and destination signatures stay downstream from source verification.Provider setupSpecial responsechallenge
FastHook keeps the provider-facing contract on the source. Accepted requests are stored before routing, while rejected requests keep enough evidence to debug signature, method, and challenge failures.

When to use this source type

Choose the TWITCH source type when Twitch is the system sending webhook requests into FastHook. The source type keeps sender-specific setup close to the source: accepted methods, verification headers, challenge handling, and the exact credential fields are documented together so operators do not need to translate a generic HMAC form into a provider-specific contract.

FastHook verifies the source before accepted traffic is queued. A valid request is stored with verified: true, then connections route it to destinations. A bad signature, wrong token, or missing provider header is rejected as SOURCE_AUTH_FAILED. A method outside the allowed set is rejected as SOURCE_METHOD_NOT_ALLOWED.

FastHook configuration

In the dashboard, create a source, set Source Type to Twitch, keep Authenticate enabled when verification is required, and fill the fields below.

Source Type

TWITCH

Allowed methods

POST, PUT, PATCH, DELETE

Authentication

Provider signature

EventSub Secret

Copy this value from Twitch and store it on the FastHook source.

{
  "type": "TWITCH",
  "config": {
    "auth_type": "PROVIDER_SIGNATURE",
    "auth": {
      "provider": "TWITCH"
    },
    "allowed_http_methods": ["POST","PUT","PATCH","DELETE"]
  }
}

HTTP methods

This source accepts only the methods listed below. Keep the set narrow so provider mistakes and accidental test calls are visible as rejected requests instead of being silently accepted.

POSTPUTPATCHDELETE

Special response: For webhook_callback_verification messages, FastHook returns the challenge value as plaintext.

Headers and verification

FastHook verifies the provider-specific values below before the request is accepted. The comparison is done against the raw inbound request body or the exact provider-specific signing input described here.

twitch-eventsub-message-id

Message id used in the signed payload.

twitch-eventsub-message-timestamp

RFC3339 timestamp used in the signed payload.

twitch-eventsub-message-signature

sha256= HMAC-SHA256 signature.

twitch-eventsub-message-type

Notification type, including webhook_callback_verification.

FastHook signs message id + timestamp + raw body with HMAC-SHA256, prefixes the digest with sha256=, and compares it with twitch-eventsub-message-signature.

Provider setup checklist

  1. Create EventSub subscriptions with webhook transport and the generated FastHook Source URL.
  2. Use the same EventSub secret in Twitch and FastHook.
  3. Keep the source enabled before creating subscriptions so Twitch callback verification can complete.
  4. Open Twitch EventSub webhook documentation when you need the provider's event list, dashboard steps, or retry policy.

Troubleshooting

  • No request appears: the provider is not calling the generated FastHook Source URL, the source URL was copied before saving, or the provider has not completed its setup validation.
  • 405 method rejected: the provider sent a method outside POST, PUT, PATCH, DELETE. Edit the source only if the provider documentation says that method is expected.
  • 401 source auth failed: check the configured FastHook field, the provider signing secret, and the header names listed on this page.
  • Signature mismatch: make sure the provider signs the same public Source URL it calls and that no proxy, parser, or manual resend changed the raw request body before FastHook received it.

Related docs