Get the signing secret
Webhooks
Get the signing secret
Each endpoint has its own secret. Every delivery is signed per Standard Webhooks: headers webhook-id, webhook-timestamp (unix seconds) and webhook-signature (v1,<base64 HMAC-SHA256> over ${id}.${timestamp}.${body}, keyed with the base64-decoded bytes after whsec_). Any Standard Webhooks library verifies it out of the box.
GET
Get the signing secret
Authorizations
Your API key: sk_test_… (sandbox) or sk_live_… (production).
Path Parameters
Webhook endpoint id.
Example:
"whe_k3m9x2pq7vn4t8wz1bcd"
Response
The current secret.
Standard Webhooks secret. Base64-decode the part after whsec_ for the HMAC key (libraries do this for you).
Example:
"whsec_Gq3n4yK8sZ2mV7xR1tL9wC5pB6hD0fJ4aE8uN2kM3oY="