Webhooks
Retrieve the signing secret
Return the account's webhook signing secret, minting it on first read. Every delivery we send is signed with it; use it to verify the signature header on your endpoint. It is not rotatable through this API.
Authorization
ApiKey AuthorizationBearer <token>
API key issued to the partner, sent with the Bearer prefix — for example: Authorization: Bearer su_key_9f2c4d1ab3….
Keys minted on the live instance are prefixed su_key_ and keys minted on sandbox su_test_key_. The two instances keep separate key tables and separate hosts, so a sandbox key sent to the live host — or the reverse — answers Invalid API key. rather than falling back to the other environment.
In: header
Response Body
application/json
application/json
application/json
curl -X GET "https://example.com/webhooks/secret/"{ "signing_secret": "whsec_3n9k2xQ7..."}