---
title: "Reveal the first verified webhook signing secret once"
method: POST
path: "/credits/tenants/me/webhook-secret/reveal"
tags: ["Webhooks"]
---

# Reveal the first verified webhook signing secret once

`POST /credits/tenants/me/webhook-secret/reveal`

## Request

- Base URL: `https://api.paywithlocus.com/api`
- URL: `https://api.paywithlocus.com/api/credits/tenants/me/webhook-secret/reveal`
- Auth: HTTP bearer

Workspace owner/admin and MFA/passkey step-up protected. Status polling cannot consume this reveal. If it was already revealed, rotate the secret instead.

## Headers

- `X-Locus-Step-Up` string, password

## Response `200`

First signing secret

- object
  - `success` unknown, required
  - `webhookSecret` string, required

## Other responses

- `409`: Verification is incomplete or the secret was already revealed

---

[API](https://skmtc.dev/paywithlocus/apis/locus-pro-api.md) - [All operations](https://skmtc.dev/paywithlocus/apis/locus-pro-api/llms.txt) - [OpenAPI document](https://skmtc.dev/paywithlocus/apis/locus-pro-api/revisions/aab8fa5d6cef?raw)