---
title: "Generate an HMAC key"
method: POST
path: "/merchants/{merchantId}/webhooks/{webhookId}/generateHmac"
tags: ["Webhooks - merchant level"]
---

# Generate an HMAC key

`POST /merchants/{merchantId}/webhooks/{webhookId}/generateHmac`

Returns an [HMAC key](https://en.wikipedia.org/wiki/HMAC) for the webhook identified in the path. This key allows you to check the integrity and the origin of the notifications you receive.By creating an HMAC key, you start receiving [HMAC-signed notifications](https://docs.adyen.com/development-resources/webhooks/verify-hmac-signatures#enable-hmac-signatures) from Adyen. Find out more about how to [verify HMAC signatures](https://docs.adyen.com/development-resources/webhooks/verify-hmac-signatures).

To make this request, your API credential must have the following [roles](https://docs.adyen.com/development-resources/api-credentials#api-permissions):
* Management API—Webhooks read and write

## Path parameters

- `merchantId` string, required
- `webhookId` string, required

## Response `200`

OK - the request has succeeded.

- GenerateHmacKeyResponse
  - `hmacKey` string, required — The HMAC key generated for this webhook.

## Other responses

- `204` — No Content - the request has been successfully processed, but there is no additional content.
- `400` — Bad Request - a problem reading or understanding the request.
- `401` — Unauthorized - authentication required.
- `403` — Forbidden - insufficient permissions to process the request.
- `422` — Unprocessable Entity - a request validation error.
- `500` — Internal Server Error - the server could not process the request.

---

[API](https://skmtc.net/adyen/apis/management-api.md) · [All operations](https://skmtc.net/adyen/apis/management-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/adyen/management-api/versions/1089ade06e17/schema)