---
title: "generate an HMAC-SHA256 signing secret for a webhook task endpoint"
method: POST
path: "/api/servicetodo/processes/tasks/webhookSigningSecret"
tags: ["tasks"]
---

# generate an HMAC-SHA256 signing secret for a webhook task endpoint

`POST /api/servicetodo/processes/tasks/webhookSigningSecret`

## Request

- Base URL: `https://services.fountain.com`
- URL: `https://services.fountain.com/api/servicetodo/processes/tasks/webhookSigningSecret`
- Auth: HTTP bearer

Generates a cryptographically secure webhook signing secret. The clear-text secret is returned exactly once and is never stored or retrievable afterwards; persist the encryptedSecret on the webhook task's content.signingSecret to enable request signing.

## Response `201`

a freshly generated webhook signing secret

- object
  - `data` object
    - `secret` string: clear-text signing secret — shown only once
    - `encryptedSecret` string: encrypted form to store on the webhook task content
  - `meta` ResponsesPartMeta
    - `timestamp` string, date-time, required
    - `verb` 'OPTION' | 'GET' | 'PUT' | 'POST' | 'PATCH' | 'DELETE'
    - `path` string
    - `jti` string
    - `rid` string
    - `count` number
    - `capped` boolean: The server lowered filter[limit] to its ceiling. Page with filter[skip] to read past it.
    - `status` string
    - `duration` number
    - `size` number

---

[API](https://skmtc.dev/fountain/apis/worker-experience-public-api.md) - [All operations](https://skmtc.dev/fountain/apis/worker-experience-public-api/llms.txt) - [OpenAPI document](https://skmtc.dev/fountain/apis/worker-experience-public-api/revisions/6b9a31f79e22?raw)