---
title: "Set a customer-provided HMAC secret for webhook signing."
method: PATCH
path: "/v1/projects/{projectId}/callbackConfig"
tags: ["brand-callbacks"]
---

# Set a customer-provided HMAC secret for webhook signing.

`PATCH /v1/projects/{projectId}/callbackConfig`

Sets a customer-provided HMAC secret for the specified project. The full secret is returned
once in the response body — this is the only time it is visible in plain text. Store it
securely immediately after this call.

## Path parameters

- `projectId` string, required

## Request body

- CallbackConfigUpdateBody — Request body for the Update Callback Configuration endpoint.
  - `hmacSecret` string, password — The HMAC secret to be updated for the specified project

## Response `200`

Secret updated. The full secret is returned once — store it securely.

- CallbackConfigSecretResponse — Response body returned once after setting or rotating the HMAC secret. The full secret is included here and will not be returned again in plain text. Store it securely immediately.
  - `projectId` string — Project ID this callback configuration belongs to.
  - `hmacSecret` string, password — The full HMAC secret for webhook signature verification. Returned only once — on creation or rotation.

## Other responses

- `400` — BAD_REQUEST: Project validation error
- `401` — UNAUTHENTICATED: Missing or invalid authentication credentials.
- `403` — PERMISSION_DENIED: The authenticated user does not have permission to perform this operation.
- `404` — NOT_FOUND: The project id introduced does not exist.
- `429` — RESOURCE_EXHAUSTED: Too many requests. The client has exceeded the rate limit.
- `500` — INTERNAL: Internal server error. Typically, a server bug.

---

[API](https://skmtc.net/sinch/apis/sinch-compliance-api-brands.md) · [All operations](https://skmtc.net/sinch/apis/sinch-compliance-api-brands/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/sinch/sinch-compliance-api-brands/revisions/fcc788f31a0a/schema)