Before message submission

1. 1

   Create an HTTPS endpoint on your backend that accepts incoming POST requests containing the sender, message text, and attachments.

   Lovable calls this URL before queuing or sending any user message to the agent.

2. 2

   Verify the incoming request signatures using the Events & Hooks signature verification method.

   This confirms that incoming validation requests are genuinely from Lovable and have not been tampered with.

3. 3

   Return an HTTP 200 status with a JSON payload specifying an 'allow' or 'deny' decision within five seconds.

   All destinations share a strict five-second deadline without retries, and any deny decision immediately blocks submission.

4. 4

   Keep the response body size under 64 KiB.

   Responses exceeding 64 KiB are invalid and will trigger failure handling.

Create a Supabase Edge Function to act as a webhook receiver for Lovable's 'Before message submission' event. The function should receive the sender, message text, and attachments, verify the signature, evaluate the message, and return an HTTP 200 JSON response with an allow or deny decision within 5 seconds.

HTTPS endpoint

A secure web address on your server set up to listen for incoming data from other services.

Signature verification

A security check that proves an incoming message truly came from Lovable and was not forged.

• Taking longer than five seconds causes the check to fail because Lovable does not retry timed-out requests.
• A single 'deny' decision from any destination completely blocks the message from being submitted.
• Conversation history is not included in the payload; you only receive the sender, message text, and attachments.