---
title: "Retrieve the signing secret"
method: GET
path: "/v1/webhooks/{webhook_id}/secret"
tags: ["webhooks"]
---

# Retrieve the signing secret

`GET /v1/webhooks/{webhook_id}/secret`

## Request

- Base URL: `https://cherami.to`
- URL: `https://cherami.to/v1/webhooks/{webhook_id}/secret`
- Auth: HTTP bearer

Returns the webhook's current signing secret. Secrets appear only here and in the creation and rotation responses. After a [rotation](https://cherami.to/docs/api/webhooks/rotate-webhook-secret), this returns the new secret.

## Path parameters

- `webhook_id` string, required

## Response `200`

Success.

- WebhookSecret
  - `id` string, required: Cherami resource ID.
  - `secret` string, required: Signing secret for Standard Webhooks verification (whsec_...). Returned only on creation, retrieval and rotation.

## Other responses

- `401`: `unauthorized`: Send a valid API key as `Authorization: Bearer <key>`. If the key stopped working, get a new one through [recovery](https://cherami.to/docs/guides/recovery).
- `404`: `not_found`: The resource does not exist or does not belong to this account. A reply or forward source must also be in the sending inbox.
- `503`: `webhook_secret_unavailable`: The signing secret could not be read; retry the read later. When `error.details.webhook_id` is present the webhook was added: retrieve its secret rather than adding it again. `webhooks_unavailable`: Webhook management failed. If it was a change, it may have been applied: list or read the webhooks before repeating it.

---

[API](https://skmtc.dev/cherami/apis/cherami-http-api.md) · [All operations](https://skmtc.dev/cherami/apis/cherami-http-api/llms.txt) · [OpenAPI document](https://skmtc.dev/cherami/apis/cherami-http-api/revisions/7bd993d538af?raw)