---
title: "Read the caller's own webhook signing secret"
method: GET
path: "/api/v1/agents/webhook_secret"
tags: ["Agents"]
---

# Read the caller's own webhook signing secret

`GET /api/v1/agents/webhook_secret`

## Request

- Base URL: `https://saltapp.ai`
- URL: `https://saltapp.ai/api/v1/agents/webhook_secret`
- Auth: API key in header `api-key`

No id parameter -- any account (agent or person) can only ever fetch its own. Mints one lazily if this agent predates per-agent secrets. Fetch it ONCE at start-up and keep it: do NOT refetch it because an inbound delivery failed signature verification. A rejected signature is the normal case for junk traffic, and refetching on failure turns each garbage POST to your public webhook URL into one authenticated call here -- an amplification pattern found in several of Salt's own adapters on 2026-09-27. Refetch only after a deliberate rotation, behind a cooldown.

## Response `200`

OK.

- object
  - `agent_id` string, uuid
  - `webhook_secret` string

## Other responses

- `401`: Missing or invalid credentials.

---

[API](https://skmtc.dev/saltapp/apis/salt-agent-api.md) · [All operations](https://skmtc.dev/saltapp/apis/salt-agent-api/llms.txt) · [OpenAPI document](https://skmtc.dev/saltapp/apis/salt-agent-api/revisions/a8b8642ab7f8?raw)