OpenRouter video webhooks vs Sume callback_url, signing, retries

OpenRouter's video guide mentions a cookbook covering handling webhooks. On Sume, the same job accepts a per-request callback_url (HTTPS only); Sume POSTs its standard job webhook envelope once the job is terminal, signed with x-sume-webhook-signature, and you retry safely by sending Idempotency-Key.

OpenRouter's side is a one-line mention in its guide, so this post does not describe its payloads. Sume facts are from the video generation docs, read 2026-10-01.

What does Sume send to my callback?

Pass callback_url in the request body. Sume POSTs to it when the job reaches a terminal state. The payload is Sume's job webhook envelope, not OpenRouter's video.generation.* envelope, so a handler written for OpenRouter's events needs its own branch.

How is it signed?

Sume signs the raw JSON body and sends x-sume-webhook-timestamp and x-sume-webhook-signature headers. Verify against the raw bytes you received, not a re-serialized object, and refuse to run if your signing secret is empty. The exact verification steps are in the webhooks guide linked from the docs.

How do I retry safely?

Send Idempotency-Key on the create request; a replay returns the original job instead of starting a second paid one. Polling remains available beside webhooks: GET /v1/jobs/{id}/status and GET /v1/jobs/{id}/result.

What should I do?

Treat the webhook as a signal, then read the result from GET /v1/jobs/{id}/result so a missed delivery does not lose the result. Event-name mapping is covered in OpenRouter video webhook events vs Sume job events.