> ## Documentation Index
> Fetch the complete documentation index at: https://docs.photalabs.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Get Webhook Secret

> Return the authenticated developer's webhook signing secret.

This is the per-developer HMAC key used to sign the ``X-Phota-Signature``
header on async job callbacks; partners fetch it once to verify callback
authenticity. The secret is minted lazily on first use. Scoped strictly to
the authenticated developer (the API key yields the developer uid).



## OpenAPI

````yaml https://api.photalabs.com/v1/phota/openapi.json get /v1/phota/webhook-secret
openapi: 3.1.0
info:
  title: Phota API
  description: Create and manage profiles for photo editing and enhancement.
  version: v0.7.0
servers:
  - url: https://api.photalabs.com
security: []
tags:
  - name: Studio
    description: Image editing, generation, and enhancement.
  - name: Profiles
    description: 'Profile lifecycle: create, query, delete.'
paths:
  /v1/phota/webhook-secret:
    get:
      tags:
        - Studio
      summary: Get Webhook Secret
      description: >-
        Return the authenticated developer's webhook signing secret.


        This is the per-developer HMAC key used to sign the
        ``X-Phota-Signature``

        header on async job callbacks; partners fetch it once to verify callback

        authenticity. The secret is minted lazily on first use. Scoped strictly
        to

        the authenticated developer (the API key yields the developer uid).
      operationId: get_webhook_secret_v1_phota_webhook_secret_get
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/WebhookSecretResponse'
        '401':
          description: Invalid API key in the X-API-Key header.
        '403':
          description: Missing X-API-Key header (no API key provided).
      security:
        - APIKeyHeader: []
components:
  schemas:
    WebhookSecretResponse:
      properties:
        webhook_signing_secret:
          type: string
          title: Webhook Signing Secret
          description: >-
            Per-developer HMAC key for verifying the X-Phota-Signature on job
            callbacks.
      type: object
      required:
        - webhook_signing_secret
      title: WebhookSecretResponse
      description: >-
        The authenticated developer's webhook signing secret (GET
        .../webhook-secret).


        The same per-developer secret used to HMAC-sign the
        ``X-Phota-Signature``

        header on async job callbacks. Use it to verify a callback's
        authenticity:

        recompute ``sha256`` HMAC over the exact received body and compare.
  securitySchemes:
    APIKeyHeader:
      type: apiKey
      in: header
      name: X-API-Key

````