---
title: "Get webhook signing secret"
method: GET
path: "/account/webhook-secret"
tags: ["Account"]
---

# Get webhook signing secret

`GET /account/webhook-secret`

Returns the webhook signing secret for your account. If no
secret exists yet, one is generated automatically on first
access.

Signing is account-scoped, not per-endpoint. Every webhook
delivery from any of your registered endpoints is signed
with this single secret. Rotate via
`POST /account/webhook-secret/rotate`.

**Secret format**: the returned string looks base64-shaped
(e.g. `XNHBBW8VqoBjRfNs1tkZj11jTk...`) but is NOT base64.
Use it AS-IS as a UTF-8 string when computing HMAC over a
delivery body. Base64-decoding before HMAC will silently
produce mismatched signatures.

See the API-level "Webhook signing" section for the full
wire format (header name, signed string shape, hash algo,
tolerance) including a language-agnostic verification
recipe.

## Response `200`

Webhook secret

- object
  - `success` true, required
  - `data` object, required
    - `secret` string, required — The webhook signing secret value

## Other responses

- `401` — Invalid or missing API key
- `404` — Resource not found

---

[API](https://skmtc.dev/primitive/apis/primitive-api.md) · [All operations](https://skmtc.dev/primitive/apis/primitive-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/primitive/primitive-api/revisions/c2299d28022c/schema)