How to Configure Webhooks in Manus AI for Automated Workflows

According to a 2025 Postman report, 89% of developers use AI in their workflows, yet only 24% design their APIs specifically to interface with autonomous AI agents. The detailed findings are published in the Postman State of the API Report. This gap is particularly evident when deploying task-running agents like Manus AI. Because Manus AI executes tasks within temporary, isolated sandboxes, any files, code, or reports generated during a run are deleted once the task container stops. To prevent data loss, developers must implement event-driven webhook patterns that immediately capture task outcomes and transfer files to a persistent workspace.

In a typical deployment, Manus AI creates short-lived execution environments to run code, scrape web pages, and analyze data. When the agent completes its assigned task, the sandbox terminates, and all local assets are wiped. Traditional storage options like local servers, Amazon S3, or Google Drive require complex, long-running setup processes or manual client interventions. This is where webhooks provide an essential link. They dispatch real-time HTTP POST notifications to a designated callback URL the moment a task finishes.

This event-driven approach consists of a five-stage lifecycle:

• First, the Manus AI agent completes its task in the sandboxed container.

• Second, Manus AI fires a task completion event to your verified HTTP receiver.

• Third, your handler processes the payload and queries the Manus Tasks API to retrieve temporary download URLs for any generated artifacts.

• Fourth, the handler requests a cloud import from a persistent workspace to secure the files.

• Fifth, once the files are securely stored, the system initiates an ownership transfer to hand over the workspace to a human client or administrator.

By automating this handoff pipeline, organizations can prevent data loss and ensure that agent outputs are securely archived for team access.

Setting up your manus ai webhook configuration requires registering a callback URL where Manus AI will send event payloads. Developers can register these endpoints using the community-maintained command line interface or directly via the REST API.

When using the CLI, you can create a webhook subscription with a single command:

manus webhook create https://your-receiver.com/webhook

For programmatic setups, developers can make an HTTP POST request to the Manus API. The platform is currently on its v2 API version, which handles webhook registration through the v2 endpoints. Note that legacy v1 endpoints are deprecated and should not be used for new integrations.

The following curl command registers a new webhook URL:

curl -X POST https://api.manus.im/v2/webhooks \
  -H "Authorization: Bearer $MANUS_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"url": "https://your-receiver.com/webhook"}'

Once registered, the Manus API will dispatch HTTP POST requests to your receiver. The payload sent to your callback URL contains metadata about the event, the task identifier, and a list of generated files.

The standard JSON payload structure for a task completion event is shown below:

{
  "eventId": "evt_987654321",
  "eventType": "task_completed",
  "timestamp": 1784567890,
  "data": {
    "taskId": "task_abc123",
    "status": "completed",
    "artifacts": [
      {
        "name": "financial_report.pdf",
        "downloadUrl": "https://storage.manus.im/temp/task_abc123/financial_report.pdf",
        "size": 2048576
      }
    ]
  }
}

This structure details the event type, such as task_completed, task_created, task_progress, or task_stopped. By listening for these event types, your backend application can track execution states and respond to completions or failures without polling the API.

Because webhooks are exposed to the public internet, verifying that incoming requests originate from Manus AI is a security requirement. Manus AI signs all webhook requests using the RSA-SHA256 signature protocol. To validate incoming requests, you must retrieve the platform's public key and parse the cryptographic signature headers.

When Manus AI calls your webhook receiver, it includes two key HTTP headers:

• X-Webhook-Signature: The base64-encoded cryptographic signature of the request.

• X-Webhook-Timestamp: The unix timestamp representing when the webhook was sent.

To verify the request, first implement replay protection. Compare the timestamp in the X-Webhook-Timestamp header against the current time of your server. Reject any requests where the difference is greater than 300 seconds (5 minutes) to protect your application from replay attacks.

Next, retrieve the Manus public key via the webhook.publicKey API endpoint. To avoid latency on every webhook delivery, cache this public key in your application memory and refresh it on an hourly schedule.

The verification signature is computed over a concatenated string of the timestamp, the target URL, and a SHA-256 hash of the request body. Below is an example of signature verification written in Node.js:

import crypto from 'crypto';
export function verifyManusSignature(rawBody, signature, timestamp, publicKeyPem) {
  const currentTime = Math.floor(Date.now() / 1000);
  if (Math.abs(currentTime - timestamp) > 300) {
    return false;
  }
  const payloadToVerify = `${timestamp}.${rawBody}`;
  const verifier = crypto.createVerify('RSA-SHA256');
  verifier.update(payloadToVerify);
  return verifier.verify(publicKeyPem, signature, 'base64');
}

Always verify the raw, unparsed request body. Parsing the body into a JSON object and then re-stringifying it can alter formatting, indentation, or key order. This alters the cryptographic hash and causes signature verification to fail.

Once you have verified the webhook payload, your receiver must extract the artifact download URLs and move them into persistent storage. Competing options like standard Amazon S3 buckets or local disks require managing custom upload logic, API credentials, and network streams. Fastio simplifies this handoff with its cloud import system, allowing you to trigger URL-based imports directly.

Using the Fastio URL Import API, your handler sends the secure, temporary download URLs provided in the Manus AI webhook payload directly to Fastio. Fastio pulls the files from Manus AI storage into your workspace without consuming your server's local bandwidth or memory.

The following Node.js function demonstrates how to process a task completion event and send the artifacts to Fastio:

import axios from 'axios';
export async function handleManusHandoff(req, res) {
  const { taskId, status, artifacts } = req.body.data;
  if (status !== 'completed' || !artifacts) {
    return res.status(200).send('Task not completed or no artifacts found.');
  }
  try {
    for (const file of artifacts) {
      const payload = {
        url: file.downloadUrl,
        filename: file.name,
        workspaceId: process.env.FASTIO_WORKSPACE_ID,
        folderPath: `/Manus-Handoffs/${taskId}`
      };
      await axios.post('https://mcp.fast.io/mcp/key', { jsonrpc: '2.0', id: 1, method: 'tools/call', params: { name: 'upload', arguments: { action: 'web-import', ...payload } } }, {
        headers: { 'Authorization': `Bearer ${process.env.FASTIO_API_KEY}` }
      });
    }
    return res.status(200).json({ success: true });
  } catch (error) {
    return res.status(500).send('Failed to import files.');
  }
}

Routing files into Fastio brings major advantages to your automated workflows:

• Shared workspaces: All teams and autonomous agents can collaborate on files in a single, organization-owned workspace.

• Per-file version history: Fastio keeps a full version history of every file. If an agent runs a task multiple times and updates a document, prior versions are preserved and can be restored, keeping the team's progress fully auditable.

• Ownership transfer: Developers or agents can set up an organization and build out workspaces for a client. When the workspace is ready, the agent can initiate an ownership transfer via a claim link. The human client then takes over the workspace and starts the 14-day free trial, which requires a credit card to activate. Fastio organization subscriptions offer plans like Starter ($29/mo), Business ($99/mo), and Growth ($299/mo). This ensures a clean path from automated generation to human ownership.

Store and Query Your Manus Agent Output Automatically

Get a persistent, shared workspace for your autonomous agents. Feed task artifacts directly into structured Metadata Views with built-in versioning and full MCP tool access. Starts with a 14-day free trial.

Start 14-Day Trial

Once files are imported into your workspace, the next challenge is extracting structured data from them. Competitor guides often overlook how raw webhook payloads can be turned into database-like schemas for human review. Fastio resolves this with Metadata Views, which turn documents into a queryable database. When files arrive from Manus AI, Metadata Views process the documents and extract structured columns without complex templates or manual OCR rules.

You can read more about data extraction on the Metadata Views page. Using this system, you can define columns in plain English, and the system automatically extracts matching fields from incoming files.

The system supports 7 field types for your database: Text, Integer, Decimal, Boolean, URL, JSON, and Date & Time. For example, if Manus AI uploads an invoice PDF, Fastio can extract the counterparty, invoice date, and total amount.

This structured database layer is separate from Intelligence Mode. While Intelligence Mode handles semantic search and conversational document summaries, Metadata Views organize files into filterable spreadsheets.

Developers can access these structures programmatically using the Fastio Model Context Protocol (MCP) server. By connecting to the Fastio storage for agents documentation or the relative API, autonomous agents can create Views, trigger document extraction, and query results. Human team members can also co-edit these documents in real time using Collaborative Notes, creating a shared workspace for humans and agents alike.

Building a reliable webhook integration requires handling network errors, key expiration, and request retries. If your webhook handler fails to parse or verify incoming requests, Manus AI will retry the delivery, which can result in duplicate events or queue congestion.

When troubleshooting your integration, focus on these common issues:

• Clock drift: Cryptographic signature verification fails if the server times are out of sync. Use network time protocol (NTP) synchronization to ensure your receiver's clock is aligned with the Manus API servers, keeping the timestamp verification window within the 300 seconds (5 minutes) limit.

• Asynchronous processing: Webhook connections can timeout if your handler performs long-running tasks, such as downloading large files, during the request handshake. Always return an HTTP 200 status code immediately upon receiving and verifying a payload. Process the file import to Fastio asynchronously in a background worker.

• Idempotency: Network drops can cause Manus AI to retry a webhook delivery even if your server already processed it. Track incoming eventId values in your database to identify and discard duplicate events, preventing redundant file imports.

• Caching errors: If you retrieve the public key on every request, your receiver will fail if the Manus API experiences transient latency. Implement local caching with an hourly refresh policy, and design a retry fallback to fetch a fresh key if a signature fails.

By implementing these verification and storage workflows, you can build a stable pipeline that bridges the gap between temporary agent sandboxes and persistent team workspaces.