---
title: "Mint (or rotate) the calling key's webhook signing secret (quota-free)."
method: POST
path: "/v1/keys/self/webhook-secret"
tags: ["self-serve"]
---

# Mint (or rotate) the calling key's webhook signing secret (quota-free).

`POST /v1/keys/self/webhook-secret`

## Request

- Base URL: `https://api.mapmap.ai`
- URL: `https://api.mapmap.ai/v1/keys/self/webhook-secret`
- Auth: one of:
  - HTTP bearer
  - API key in query parameter `api_key`

## Response `200`

The new secret, shown exactly once. Calling again mints another and invalidates this one, including for deliveries already in flight

- WebhookSecretResponse: The webhook signing secret, shown exactly once.
  - `created_at` string, required: RFC 3339 UTC time this secret was minted.
  - `key_id` string, required: The key this secret signs for.
  - `signature_header` string, required: The header to verify: `X-MapMap-Signature`, the lowercase hex HMAC-SHA256 of the raw request body under this secret.
  - `webhook_secret` string, required: The secret itself: 64 lowercase hex characters. **Shown once.** Calling again mints a new one and invalidates this.

## Other responses

- `401`: Missing or invalid API key

---

[API](https://skmtc.dev/mapmap/apis/sn-gateway.md) · [All operations](https://skmtc.dev/mapmap/apis/sn-gateway/llms.txt) · [OpenAPI document](https://skmtc.dev/mapmap/apis/sn-gateway/revisions/2293be8b4c38?raw)