> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://developers.deepgram.com/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://developers.deepgram.com/_mcp/server.

## Verify Callback Requests with Basic Auth or Extra Metadata

The `dg-token` header is no longer a supported method to verify that callback requests come from Deepgram. If your callback server checks for `dg-token`, switch to Basic Auth. For Speech-to-Text, you can also use a secret passed with [Extra Metadata](/docs/extra-metadata).

See [STT Callback](/docs/callback#authenticating-callback-requests), [TTS Callback](/docs/tts-callback#authenticating-callback-requests), and [Text Intelligence Callback](/docs/text-intelligence-callback#authenticating-callback-requests) for details.

### Speech-to-Text (`/v1/listen`)

- **Basic Auth (recommended)**: put credentials in the callback URL, such as `https://username:password@example.com/callback`. Deepgram includes these credentials when it sends results to your callback server. Your server can then reject any request that doesn't have the expected credentials.
- **Secret in Extra Metadata**: send a random secret as an [`extra`](/docs/extra-metadata) key-value pair with your request:

```txt
https://api.deepgram.com/v1/listen?callback=https://example.com/callback&extra=callback_secret:YOUR_SECRET_VALUE
```

Deepgram returns the extra metadata in `metadata.extra.callback_secret` in the callback request body. Reject any callback where the value is missing or doesn't match.

### Text-to-Speech (`/v1/speak`) and Text Intelligence (`/v1/read`)

Use Basic Auth. Embed credentials in the callback URL as described above.