Skip to main content
GET
Reveal the signing secret

Authorizations

Authorization
string
header
required

Server API key, scoped. pk_test_ keys hit the sandbox tenant.

Headers

X-Step-Up-Token
string
required

Proof of a 2FA step-up within the last 5 minutes (POST /v1/auth/step-up).

X-Request-Id
string

Optional client correlation id, up to 128 characters. It is not echoed: the response's X-Request-Id is always our own req_… id. We log your value with the request as client_request_id, so support can find a request by either id. A longer value is refused with 400 parameter_invalid.

Maximum string length: 128

Path Parameters

webhook_id
string
required

Webhook endpoint id.

Pattern: ^whe_[0-9A-HJKMNP-TV-Z]{26}$

Response

The secret.

The current signing secret.

object
string
required

Always webhook_secret.

Allowed value: "webhook_secret"
webhook_id
string
required

Endpoint.

Pattern: ^whe_[0-9A-HJKMNP-TV-Z]{26}$
secret
string
required

whsec_….

Pattern: ^whsec_[A-Za-z0-9]{24,}$
created_at
string<date-time>
required

When this secret was created (endpoint creation or last roll).

Example:

"2026-10-27T08:41:00Z"