Get webhook signing secret

Returns the webhook signing secret for your account. If no secret exists yet, one is generated automatically on first access.

Signing is account-scoped, not per-endpoint. Every webhook delivery from any of your registered endpoints is signed with this single secret. Rotate via POST /account/webhook-secret/rotate.

Secret format: the returned string looks base64-shaped (e.g. XNHBBW8VqoBjRfNs1tkZj11jTk...) but is NOT base64. Use it AS-IS as a UTF-8 string when computing HMAC over a delivery body. Base64-decoding before HMAC will silently produce mismatched signatures.

See the API-level "Webhook signing" section for the full wire format (header name, signed string shape, hash algo, tolerance) including a language-agnostic verification recipe.