---
title: "Get webhook signing key"
method: GET
path: "/v1/webhooks/keys/{keyId}"
tags: ["Webhooks"]
---

# Get webhook signing key

`GET /v1/webhooks/keys/{keyId}`

Retrieve a webhook public signing key by ID, in PEM format.

The IDs used for this endpoint are supplied in the `x-akahu-payments-signing-key` header on webhook requests.

This key can be used to verify a one-off payment webhook by:

1. Taking the signature from the webhook request's `x-akahu-payments-signature` header.

2. Taking the webhook signing key ID from the webhook request's `x-akahu-payments-signing-key` header.

3. Fetching the webhook signing key from this endpoint, using the ID from step 2. This should be cached.

4. Taking the raw body from the webhook request (before any parsing is applied)

5. Use the public key to verify that the body was correctly signed (using RSA-SHA256). This varies by language, see our article on [enduring webhooks](https://developers.akahu.nz/docs/reference-webhooks#/verification) for some examples.

## Path parameters

- `keyId` string, required

## Response `200`

Success

- object
  - `keyId` string, required
  - `publicKey` string, required

## Other responses

- `400` — Bad Request
- `401` — Unauthorized
- `403` — Forbidden

---

[API](https://skmtc.dev/akahu/apis/akahu-enduring-api.md) · [All operations](https://skmtc.dev/akahu/apis/akahu-enduring-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/akahu/akahu-enduring-api/revisions/b2de9915920d/schema)