> ## Documentation Index
> Fetch the complete documentation index at: https://docs.valendata.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Get your webhook signing secret

> The secret that signs your webhook deliveries, for verifying X-Valendata-Signature.

Each delivery to your `webhook_url` carries two headers:

```http theme={null}
X-Valendata-Timestamp: <unix seconds>
X-Valendata-Signature: v1=<hex HMAC-SHA256(secret, "<timestamp>.<raw body>")>
```

Compute the signature over the raw request body, compare it in constant time, and reject timestamps more than 5 minutes old. The [Web to API guide](/guides/web-to-api#webhooks) has Python and TypeScript examples.

For 24 hours after you [rotate the secret](/api-reference/webhooks/rotate-secret), the header carries two values, new first: `v1=<new>,v1=<old>`. Split on commas and accept the delivery when any value matches.

Reading the secret with an API key needs the `webhooks:read` scope. You can also see it, and rotate it, in **Settings → API Keys** in the app.


## OpenAPI

````yaml GET /v1/webhooks/secret
openapi: 3.0.3
info:
  title: Valendata REST API
  version: 1.0.0
  description: >-
    Trigger Skills, manage Workflows, retrieve Runs, and stream structured
    results from any language using JSON over HTTPS.
servers:
  - url: https://api.valendata.com
    description: Production
security:
  - ApiKeyAuth: []
tags:
  - name: Skills
    description: Execute and inspect published Skills.
  - name: Workflows
    description: Trigger multi-step Workflows and list them.
  - name: Runs
    description: Start async Skill runs and read Skill and Workflow run results.
  - name: Skill creation
    description: Create a Skill from a plain-language task.
  - name: Skill improvement
    description: >-
      Fix a Skill, add fields to it or re-learn its detail steps, poll the
      result, and read its change history.
  - name: Versions
    description: List, diff, restore, and pin a Skill's recipe versions.
  - name: Webhooks
    description: Signed delivery of finished async runs.
paths:
  /v1/webhooks/secret:
    get:
      tags:
        - Webhooks
      summary: Get your webhook signing secret
      description: >-
        The secret your webhook deliveries are signed with. Each delivery
        carries `X-Valendata-Timestamp` and `X-Valendata-Signature: v1=<hex
        HMAC-SHA256(secret, "<timestamp>.<raw body>")>`. Needs the
        `webhooks:read` scope when called with an API key. For 24 hours after a
        rotation the signature header carries two comma-separated values, new
        first.
      operationId: getWebhookSecret
      responses:
        '200':
          description: Your signing secret.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/WebhookSecret'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
      security:
        - ApiKeyAuth: []
components:
  schemas:
    WebhookSecret:
      type: object
      properties:
        secret:
          type: string
          description: Your signing secret. Keep it private.
        signature_header:
          type: string
          example: X-Valendata-Signature
        algorithm:
          type: string
          example: HMAC-SHA256 over '<timestamp>.<raw body>'
        previous_valid_until:
          type: string
          format: date-time
          nullable: true
          description: >-
            Set for 24 hours after a rotation: until then deliveries are also
            signed with the previous secret.
        rotated_at:
          type: string
          format: date-time
          nullable: true
          description: When the secret was last rotated.
    Error:
      type: object
      properties:
        detail:
          oneOf:
            - type: string
            - type: object
              additionalProperties: true
          description: >-
            Error message. Usually a plain string; may be a structured object
            for some errors.
      example:
        detail: Invalid or expired API key
  responses:
    Unauthorized:
      description: >-
        Unauthorized. The Authorization header is missing, malformed, or the
        credential is invalid or expired.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/Error'
    Forbidden:
      description: >-
        Forbidden. You may not run or change this Skill, or it is not published
        or active.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/Error'
  securitySchemes:
    ApiKeyAuth:
      type: http
      scheme: bearer
      bearerFormat: vd_sk_...
      description: >-
        API key with the `vd_sk_` prefix. Create keys from Settings, API Keys in
        the dashboard.

````

This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.