Skip to main content
POST
Reveal the active webhook signing secret
Returns the active signing secret in full, ready to paste into a Standard Webhooks library. This is a POST rather than a GET so the value never lands in a URL, a proxy access log, or a browser history entry. You can reveal the secret whenever you need it — rotation is for a secret that has leaked, not for one you have mislaid. See verifying a webhook.
These endpoints need the webhook:manage scope. Your dashboard session carries it, so Account → Webhooks always works. An API key does not carry it by default — a key that only moderates content must not be able to read the credential that proves a callback came from us. Contact support if you need it on a key.

Authorizations

Authorization
string
header
required

API key from the Omnifence dashboard

Response

200 - application/json

Default Response

secret
string
required
secrets
object[]
required