Skip to navigation

Changelog

October 27, 2026

Verify Callback Requests with Basic Auth or Extra Metadata

The dg-token header is no longer a supported method to verify that callback requests come from Deepgram. If your callback server checks for dg-token, switch to Basic Auth. For Speech-to-Text, you can also use a secret passed with Extra Metadata.

See STT Callback, TTS Callback, and Text Intelligence Callback for details.

Speech-to-Text (/v1/listen)

  • Basic Auth (recommended): put credentials in the callback URL, such as https://username:password@example.com/callback. Deepgram includes these credentials when it sends results to your callback server. Your server can then reject any request that doesn’t have the expected credentials.
  • Secret in Extra Metadata: send a random secret as an extra key-value pair with your request:
https://api.deepgram.com/v1/listen?callback=https://example.com/callback&extra=callback_secret:YOUR_SECRET_VALUE

Deepgram returns the extra metadata in metadata.extra.callback_secret in the callback request body. Reject any callback where the value is missing or doesn’t match.

Text-to-Speech (/v1/speak) and Text Intelligence (/v1/read)

Use Basic Auth. Embed credentials in the callback URL as described above.