Hermes webhooks

Give Hermes a secure public webhook URL without exposing its Agent API.

Hermes receives webhook events on port 8644, which Agent37 keeps credential-protected by default. This page covers the Agent37-specific step: giving that port a stable public URL without exposing the Agent API on port 3737.

Paste this into your coding agent

Read https://www.agent37.com/docs/llms-full.txt.
I have an agent37-hermes instance with a Hermes webhook subscription and want it to receive deliveries on a public URL without exposing its Agent API.
Hermes listens on port 8644: create a public port on it with the prefix webhooks (POST /v1/instances/{id}/public-ports) and give me the public origin that replaces http://localhost:8644 in the URL Hermes shows.
Done when a POST to https://webhooks-{instanceId}.agent37.app/webhooks/<subscription-name> reaches Hermes without an Agent37 key.
My key is in AGENT37_API_KEY.

For Hermes route configuration, payload templates, delivery targets, and supported signatures, use the Hermes webhook guide.

1. Create the Hermes subscription

Open the Hermes dashboard on port 9119 with a signed URL, then select Webhooks. Enable the receiver if needed and create a subscription. Agent37 manages the Hermes gateway restart.

Hermes shows a local URL and a signing secret when the subscription is created:

http://localhost:8644/webhooks/call-ended

Copy the secret when Hermes shows it. Keep the /webhooks/call-ended path; replace only the local origin below.

2. Give port 8644 a named URL

Add a prefix to make the hostname readable and stable:

curl -X POST https://api.agent37.com/v1/instances/ab12cd34ef/public-ports \
  -H "Authorization: Bearer sk_live_..." \
  -H "Content-Type: application/json" \
  -d '{ "port": 8644, "prefix": "webhooks" }'

{
  "port": 8644,
  "url": "https://webhooks-ab12cd34ef.agent37.app",
  "domain_urls": [],
  "prefix": "webhooks",
  "created": 1783900800
}

A prefix produces {prefix}-{instanceId}.agent37.app; it does not claim a global bare hostname. Omit prefix if you prefer a random, unguessable hostname. See Public ports for creation-time configuration, rotation, and limits.

3. Replace the local origin

Combine the returned Agent37 origin with the path Hermes showed:

https://webhooks-ab12cd34ef.agent37.app/webhooks/call-ended

Configure the external service with this URL and the Hermes signing secret. The public URL supplies reachability; Hermes still authenticates the delivery using the signature rules in its documentation.

Test the subscription locally from the instance terminal, then use the provider’s test-delivery feature:

hermes webhook test call-ended

Do not test with {url}/health. Agent37 reserves /health at the edge, so that path does not reach Hermes.