Source: https://01router.com/docs/callback
Base URL: https://01router.com/api/v1

# Callbacks

Add callback_url (public https) and we POST the final generation object to it once the task succeeds or fails, retrying up to 5 times with backoff, so you don't need to poll.

## Input parameters

| Field | Type | Required | Description | Constraints |
| --- | --- | --- | --- | --- |
| callback_url | string<uri> | no | Public HTTPS URL, up to 1,000 characters. Receives the final generation object. Private network addresses are rejected. |  |

## Response fields

| Field | Type | Required | Description | Constraints |
| --- | --- | --- | --- | --- |
| id | string | — | Generation ID returned by the create request. |  |
| object | "generation" | — | generation |  |
| model | string | — | Model slug from the catalog. Project keys may use a project-specific model slug. |  |
| type | video \| image \| audio \| chat | — |  |  |
| provider | string | — | Optional provider slug. Omit for automatic routing; project settings may pin the provider. |  |
| status | string | — | queued / processing / succeeded / failed. Stop polling on succeeded or failed. |  |
| input | object | — | Model-specific input object. See the selected model reference for required fields, defaults and limits. |  |
| outputs | string[] | — | Result file URLs. Empty until available; download promptly because URLs may expire. |  |
| error | string \| null | — | Error message on failure; null otherwise. |  |
| credits | number | — | Credits charged for this generation; zero after a refund. |  |
| price_usd | number | — | Price of this generation in USD; zero after a refund. |  |
| created_at | string | — | Creation time in ISO 8601 format. |  |
| completed_at | string \| null | — | Completion time in ISO 8601 format, or null while running. |  |

## cURL

```bash
curl 'https://01router.com/api/v1/generations' \
  -H "Authorization: Bearer $API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
  "model": "seedance-2.5",
  "input": {
    "prompt": "A red fox running through fresh snow, cinematic"
  },
  "callback_url": "https://your-app.com/webhooks/generation"
}'
```

## Node.js · HMAC-SHA256

```javascript
import { createHmac, timingSafeEqual } from 'node:crypto';

// rawBody is the original request body, before JSON parsing.
const timestamp = request.headers.get('x-gateway-timestamp') ?? '';
const signature = request.headers.get('x-gateway-signature') ?? '';
const expected = 'sha256=' + createHmac('sha256', process.env.API_KEY)
  .update(timestamp + '.' + rawBody).digest('hex');
const received = Buffer.from(signature);
const signed = Buffer.from(expected);
const fresh = /^\d+$/.test(timestamp) &&
  Math.abs(Date.now() / 1000 - Number(timestamp)) <= 300;
const valid = fresh && received.length === signed.length &&
  timingSafeEqual(received, signed);
if (!valid) throw new Error('Invalid callback signature');
```

## Usage notes

- Each callback carries X-Gateway-Timestamp and X-Gateway-Signature: sha256=HMAC-SHA256(your API key, timestamp + "." + raw body). Verify it, or simply re-fetch GET /generations/:id.
- Handle callbacks idempotently by generation ID. Verify the signature against the original raw body and reject stale timestamps. A session-created task may have no signature; API integrations should create tasks with a key.