How it works
To use your own backend, click the “Connect Your Backend” button on your agent, and then set the Webhook URL to point to your backend’s endpoint.
- Transcribe the user’s speech to text.
- Send an HTTP POST request to your backend at the Webhook URL you provide.
- Your backend responds with a Server-Sent Events (SSE) stream containing the agent’s reply (text to be spoken, and optional data).
- Layercode handles converting the text in your response to speech and streaming it back to the user in real time.
- Return of JSON data is also supported to allow you to pass state back to your UI.

Configuring Your Agent
- In the Layercode dashboard, open your agent and click Connect Your Backend (or click the edit button in the Your Backend box if you’ve already connected your backend previously).
- Enter your backend’s Webhook URL in the configuration modal.
- Optionally, configure which webhook events you want to receive (see below).
- Save your changes.
Webhook Events
- message (required):
Sent when the user finishes speaking. Contains the transcribed message and metadata. Your backend should respond with an SSE stream containing the agent’s reply. - session.start (optional):
Sent when a new session is started (e.g., when a user connects). Use this to have your agent start the conversation. If disabled, the agent will wait for the user to speak first when a new session is started.
Webhook Verification
To ensure the security of your backend, it’s crucial to verify that incoming requests are indeed from Layercode. This can be done by verifying thelayercode-signature
header, which contains a timestamp and a HMAC-SHA256 signature of the request body.
Here’s how you can verify the signature in your backend:
- Retrieve the
layercode-signature
header from the request. It will be in the format:t=timestamp,v1=signature
. - Get your Layercode webhook secret from the Layercode dashboard (found by going to the appropriate agent and clicking the edit button in the Your Backend box, where you’ll find the Webhook Secret).
- Reconstruct the signed payload by concatenating the timestamp, a period (
.
), and the exact raw webhook request body:signed_payload = timestamp + "." + request_body
. - Compute the HMAC-SHA256 signature of this signed payload using your webhook secret.
- Compare the computed signature with the
v1
value from thelayercode-signature
header. If they match, the request is valid. - (Recommended) Check that the timestamp is recent (for example, within 5 minutes) to prevent replay attacks.
Example: Webhook Request
When a user finishes speaking, Layercode will send a POST request to your webhook with the following JSON payload body:Example: SSE Response
Your backend should respond with an SSE stream. Each SSE message contains a JSON payload with the following fields:type
, content
(when required) and turn_id
. See the Webhook SSE API documentation for details.