Reveal the secret

Read a webhook endpoint's current signing secret again.

GET{BASE_URL}/webhooks/{id}/secret

Returns the endpoint's current signing secret. Localoy must hold the secret to sign deliveries with it, so unlike a key it can be read again — use this when you configure a new receiver, instead of copying the secret between systems by hand. Requires a provider key; the partner header is ignored.

This is the only read that returns the secret, and it returns nothing else about the endpoint.

Path parameters

idstringrequired: The endpoint's ID.

Response

data.idstringrequired: The endpoint's ID.
data.secretstringrequired: The signing secret, starting whsec_. Use it whole, prefix included, as the HMAC key.
data.secretRotatedAtstring | nullrequired: When the secret was last rotated, or null if it never was.

Status codes#

Status	Code	Meaning
`200`	—	Success.
`403`	`provider_key_required`	A partner key made the call.
`404`	`webhook_endpoint_not_found`	You have no endpoint with that ID.

curl "$LOCALOY_BASE_URL/webhooks/cm8wh00k0000000000000001/secret" \
  -H "Authorization: Bearer $LOCALOY_PROVIDER_KEY"

Response · 200

{
  "success": true,
  "data": {
    "id": "cm8wh00k0000000000000001",
    "secret": "whsec_Xq9vT0bLm3Rk8sYw2Ea5Nc7Pd1Gf4Hj6Kl9Mn0Qr3St",
    "secretRotatedAt": null
  }
}