---
title: "Get Webhook Secret"
method: GET
path: "/v3/webhook-secret"
tags: ["Webhooks"]
---

# Get Webhook Secret

`GET /v3/webhook-secret`

**Get the current webhook signing secret.**

Returns the active secret used to sign outbound webhook deliveries via the `bem-signature`
header. Returns 404 if no secret has been generated for this environment yet.

Use the secret to verify incoming webhook payloads:
1. Parse `bem-signature: t={timestamp},v1={signature}`.
2. Construct the signed string: `{timestamp}.{raw request body}`.
3. Compute HMAC-SHA256 of that string using the secret.
4. Compare the hex digest against `v1`.
5. Reject requests where the timestamp is more than a few minutes old.

## Response `200`

The request has succeeded.

- WebhookSecret — Webhook signing secret used to verify `bem-signature` headers on delivered webhooks.
  - `secret` string, required — The signing secret value. Store this securely — it is shown in full only on generation.

## Changes

- **2026-05-07** `9b21faaa53ca` — 2 info
  - api tag `Webhooks` added
  - api tag `Webhook Signing` removed
- **2026-04-14** `21dd68d36c71` — 1 info
  - endpoint added

[Change history](https://skmtc.dev/bem-team/apis/bem-api/changes/v3/webhook-secret/get.md)

---

[API](https://skmtc.dev/bem-team/apis/bem-api.md) · [All operations](https://skmtc.dev/bem-team/apis/bem-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/bem-team/bem-api/revisions/5b0d4b491ca7/schema)