Get the webhook signing secret

GET/signing-secret

Sample request

cURL

curl -H "x-api-key: $ABYSSALE_API_KEY" \
  https://api.abyssale.com/signing-secret
# {"secret":"whsec_…","created_at_ts":1755561234,"rotated_at_ts":null}

Node.js

import abyssale from '@abyssale/sdk';

const { data, error } = await abyssale.getSigningSecret();

if (error) console.error(error.id, error.message);
else console.log(data);

Python

from abyssale import Abyssale

with Abyssale() as client:
    result = client.get_signing_secret()

print(result)

Example 200 response

{
  "secret": "whsec_2f1a8c4e6b9d0a7c3e5f8b1d4a6c9e2f0b3d5a7c1e4f6b8d0a2c5e7f9b1d3a5c",
  "created_at_ts": 1755561234
}

Example 401 error response

{
  "message": "Unauthorized: missing or invalid API key.",
  "id": "unauthorized"
}

Retrieve the workspace's webhook signing secret, creating it on the first call and returning the same value on every call after that.

Behaviour, limits and caveats

One secret covers every webhook in the workspace — dashboard subscriptions and per-job callback_url deliveries alike. Fetch it once at setup and store it with your other credentials.

Use it to verify the X-Abyssale-Signature header on incoming deliveries; the header format and ready-made verification snippets are in the Webhooks section of the introduction. Keep it server-side: a signature computed in a browser is a secret you have published.

A workspace with no secret receives unsigned deliveries; the secret coming into existence is what turns signing on. This endpoint is the normal way to create it, but rotate and revoke mint one too if none exists.

Response 200

The workspace's signing secret.

secret string always

The secret to verify X-Abyssale-Signature with. Prefixed whsec_ so it is recognisable if it turns up somewhere it should not.

created_at_ts integer always

Unix second the secret was first issued.

rotated_at_ts integer | null

Unix second of the most recent rotation, or null if the secret has never been rotated.

previous_secret_expires_at_ts integer | null

When the previous secret stops being honoured — 24 hours after the rotation that demoted it.

More about previous_secret_expires_at_ts

When the previous secret stops being honoured — 24 hours after the rotation that demoted it. null when there is no overlap in progress, either because nothing was rotated, because the window has lapsed, or because it was ended with POST /signing-secret/revoke.

While this is set, deliveries carry two v1 hashes and a receiver holding either secret verifies. The previous secret's value is never returned — only its expiry.

Errors

Every failure uses the shared error envelope — {id, message, errors?}. Branch on id, never on message. See Errors.

Status	When
401	Unauthorized — missing or invalid API key.
429	Too Many Requests.
500	Internal Server Error — an unexpected error occurred on our side.