Deploy a LINE Webhook Gateway Safely

LINE delivers messages to Hermes through a public HTTPS webhook. The channel secret authenticates inbound requests, while the channel access token authorizes replies. Because the route is internet-facing, hostname stability, signature validation, and sender authorization are release requirements.

Official documentation: https://hermes-agent.nousresearch.com/docs/user-guide/messaging/line

Prepare the LINE channel

Create a Messaging API channel in the LINE Developers Console. Record the channel secret and issue a long-lived channel access token. Disable LINE's built-in greeting and auto-reply features when Hermes should own the conversation; otherwise users may receive competing answers.

Expose the gateway with a stable HTTPS address. A temporary tunnel is useful for development, but a rotating hostname is brittle for production because both the LINE console and Hermes configuration must match it. The documented webhook path ends in /line/webhook.

Launch checklist

Create the LINE provider and Messaging API channel.
Store the channel secret and access token outside source control.
Disable conflicting greeting and auto-reply behavior.
Establish a stable HTTPS route to the webhook listener.
Configure the public base URL required for outbound media.
Run hermes gateway setup and select LINE.
Set a narrow user allowlist or approved access policy.
Enter the exact webhook URL in LINE and pass its verification check.
Enable webhook delivery only after the listener is ready.

Account for slow responses and media

Webhook acknowledgement and model generation have different timing constraints. The adapter should acknowledge valid inbound events without making LINE wait for an entire long-running agent task. For lengthy work, send a concise status response and deliver the result when it is ready rather than retrying the original event.

Images, audio, and video require a public base URL that LINE can reach. Verify each media type separately; plain-text success does not validate media hosting, MIME type, or expiration behavior.

Common pitfalls

Omitting the /line/webhook path from the console URL.
Using a temporary tunnel hostname as if it were durable infrastructure.
Leaving LINE auto-replies enabled alongside Hermes.
Allowing all senders during a production rollout.
Logging the access token or full webhook payload during troubleshooting.
Forgetting to configure the public base URL before testing media.

Verification steps

Use the LINE console's verification action and confirm a 200 response.
Send a direct message from an allowed user and verify exactly one reply.
Send from an unauthorized identity and confirm the configured denial or pairing behavior.
Test a deliberately slow request and check that LINE does not create duplicate work.
Send one image or audio artifact and confirm it opens on a separate device.
Restart the LINE adapter and repeat the text test.
Review logs for failed signatures, repeated deliveries, expired media URLs, and accidental credential output.