---
title: "Webhook signing secret"
method: GET
path: "/v1/files/webhook-secret"
tags: ["narrador files"]
---

# Webhook signing secret

`GET /v1/files/webhook-secret`

## Request

- Base URL: `https://api.narrador.io`
- URL: `https://api.narrador.io/v1/files/webhook-secret`
- Auth: one of:
  - HTTP bearer
  - API key in header `x-api-key`

Returns the HMAC signing secret for the authenticated `nrd_files_` API key. Use it to verify `X-Narrador-Signature` on job webhooks. OAuth-only auth is not supported.

## Response `200`

Signing secret for webhook verification

- object
  - `signingSecret` string, required

## Other responses

- `400`: Requires a files API key
- `401`: Unauthorized — missing or invalid API key (wrong prefix, revoked, or expired).
- `403`: Forbidden — API key scope does not match the endpoint (e.g. `nrd_x_` key on a narrador files route), insufficient narrador credits for a synchronous operation (e.g. narrador X generate), or other entitlement failure. narrador files jobs that run out of credits finish asynchronously with job status `not-enough-credits` instead of HTTP 403.
- `429`: Too many requests — API key verification rate limit exceeded (60 requests per 60 seconds per key).

---

[API](https://skmtc.dev/narrador/apis/narrador-api.md) · [All operations](https://skmtc.dev/narrador/apis/narrador-api/llms.txt) · [OpenAPI document](https://skmtc.dev/narrador/apis/narrador-api/revisions/e9f026c76832?raw)