---
title: "Get Webhook Secret"
method: GET
path: "/v2/phota/webhook-secret"
tags: ["Studio"]
---

# Get Webhook Secret

`GET /v2/phota/webhook-secret`

## Request

- Base URL: `https://api.photalabs.com`
- URL: `https://api.photalabs.com/v2/phota/webhook-secret`
- Auth: API key in header `X-API-Key`

Return the authenticated developer's webhook signing secret.

This is the per-developer HMAC key used to sign the ``X-Phota-Signature``
header on async job callbacks; partners fetch it once to verify callback
authenticity. The secret is minted lazily on first use. Scoped strictly to
the authenticated developer (the API key yields the developer uid).

## Response `200`

Successful Response

- WebhookSecretResponse: The authenticated developer's webhook signing secret (GET .../webhook-secret). The same per-developer secret used to HMAC-sign the ``X-Phota-Signature`` header on async job callbacks. Use it to verify a callback's authenticity: recompute ``sha256`` HMAC over the exact received body and compare.
  - `webhook_signing_secret` string, required: Per-developer HMAC key for verifying the X-Phota-Signature on job callbacks.

## Other responses

- `401`: Invalid API key in the X-API-Key header.
- `403`: Missing X-API-Key header (no API key provided).

---

[API](https://skmtc.dev/photalabs/apis/phota-api.md) - [All operations](https://skmtc.dev/photalabs/apis/phota-api/llms.txt) - [OpenAPI document](https://skmtc.dev/photalabs/apis/phota-api/revisions/951f156f1f6c?raw)