---
title: "Mint or rotate the webhook signing secret"
method: POST
path: "/v1/webhooks/signing-secret"
tags: ["Agents"]
---

# Mint or rotate the webhook signing secret

`POST /v1/webhooks/signing-secret`

## Request

- Base URL: `https://api.pyai.com`
- URL: `https://api.pyai.com/v1/webhooks/signing-secret`
- Auth: one of:
  - HTTP bearer
  - API key in header `x-api-key`

Mint (or rotate) your org's webhook signing secret and return it **once**. Verify the `X-PyAI-Signature` on post-call extraction (and transcription-job) webhooks with it: HMAC-SHA256 over `"<t>.<rawBody>"`. Zero-drop rotation: deploy verification that accepts both the old and new secret, call this, then drop the old one. Requires the `omni:session` scope.

## Response `200`

The new secret (shown once)

- object
  - `object` string
  - `secret` string: The signing secret (`whsec_…`). Stored server-side; shown only in this response.
  - `created_at` integer

## Other responses

- `401`: Missing or invalid API key (`code: unauthorized`)

---

[API](https://skmtc.dev/pyai/apis/pyai-api.md) · [All operations](https://skmtc.dev/pyai/apis/pyai-api/llms.txt) · [OpenAPI document](https://skmtc.dev/pyai/apis/pyai-api/revisions/271a1539185b?raw)