---
title: "Get the webhook signing secret"
method: GET
path: "/users/me/webhook-secret"
tags: ["users"]
---

# Get the webhook signing secret

`GET /users/me/webhook-secret`

## Request

- Base URL: `https://api.sytecheck.app` (the document declares no server; this is the origin it was published from)
- URL: `https://api.sytecheck.app/users/me/webhook-secret`
- Auth: HTTP bearer

Return the secret used to verify scan webhook deliveries. Unlike an API key it
can be read as often as needed — it verifies that a delivery came from us and
grants no access on its own.

Requires an interactive session and a plan that includes webhooks.

## Response `200`

Successful Response

- WebhookSecretResponse: An account's outbound webhook signing secret. Returned in full on every read, unlike an API key, and the difference is deliberate. A key is a *bearer* credential — anyone holding it can act as the account, so it is stored hashed and shown once. This secret grants no access to anything: it only lets the holder verify that a delivery came from us. The cost of showing it again is therefore low, and the cost of *not* showing it is high — a customer who loses it would otherwise have to rotate, breaking a working integration to recover a value we can simply re-derive.
  - `secret` string, required: The signing secret, as `whsec_<hex>`. Configure it in the receiver that verifies the `X-SyteCheck-Signature` header.
  - `version` integer, required: Rotation counter. Rotating issues a new secret and immediately invalidates the previous one, so update the receiver first.
  - `signature_max_age_seconds` integer, required: How old a signed timestamp may be before a receiver should reject the delivery as a replay.

---

[API](https://skmtc.dev/sytecheck/apis/sytecheck-api.md) · [All operations](https://skmtc.dev/sytecheck/apis/sytecheck-api/llms.txt) · [OpenAPI document](https://skmtc.dev/sytecheck/apis/sytecheck-api/revisions/797cf6b3e867?raw)