---
title: "Fetch the caller's webhook signing secret"
method: GET
path: "/api/webhooks/secret"
---

# Fetch the caller's webhook signing secret

`GET /api/webhooks/secret`

## Request

- Base URL: `https://api.peelaway.io`
- URL: `https://api.peelaway.io/api/webhooks/secret`
- Auth: HTTP bearer

Returns the per-user HMAC secret used to sign webhook callbacks, so receivers can verify X-Peelaway-Signature. Authenticated; read-only.

## Response `200`

The signing secret

- WebhookSecretResponse
  - `secret` string, required: Per-user HMAC signing secret (hex). Recompute X-Peelaway-Signature with it to verify callbacks.

## Other responses

- `401`: Authentication required

---

[API](https://skmtc.dev/peelaway/apis/peelaway-image-api.md) · [All operations](https://skmtc.dev/peelaway/apis/peelaway-image-api/llms.txt) · [OpenAPI document](https://skmtc.dev/peelaway/apis/peelaway-image-api/revisions/8ce45533c9d0?raw)