Set Signing Secret

Generate or replace the secret used to sign webhook deliveries.

POST /webhooks/indexing/signing-secret

Python SDK

result = client.webhooks.set_signing_secret()
secret = result.data.signing_secret

200

{
  "data": {
    "generated": true,
    "message": "Success",
    "signing_secret": "whsec_EXAMPLE_ONLY_THIS_IS_NOT_A_REAL_SIGNING_KEY"
  },
  "error": null,
  "meta": {
    "collection": "team_docs",
    "database": "acme_corp",
    "latency_ms": 12.3,
    "request_id": "9d13aef4-02f4-4e73-8c62-4c2601d04f9d",
    "source_type": "file",
    "sub_tenant_id": "team_docs",
    "tenant_id": "acme_corp"
  },
  "success": true
}

Generates a signing secret for an existing webhook, or replaces it with the signing_secret you supply. A supplied secret must contain at least 16 characters. The secret is returned once in data.signing_secret; store it securely, since it cannot be read back.

Rotation takes effect immediately. If you supply your own secret, configure your receiver to accept it before making this call. See Secret rotation.

Python SDK

result = client.webhooks.set_signing_secret()
secret = result.data.signing_secret

To enable signing when creating a webhook, use generate_signing_secret: true on Register Webhook. If no webhook is registered, this endpoint returns 404.

Related resources

• Webhooks guide: verify signatures on your receiver
• Send Test Delivery: check signature verification
• Disable Signing: remove the secret

Authorizations

Authorization · string · header · required

API key sent as a Bearer token: "Bearer prefix.secret"

Body

application/json

Omit the body to have a secret generated for you

signing_secret · string

Secret used to sign webhook payloads. Deliveries carry X-HydraDB-Signature: sha256=<hex>, the HMAC-SHA256 of the raw request body keyed by this secret. Minimum 16 characters when you supply your own; omit it and one is generated for you. On registration, omitting this field preserves any existing secret - to disable signing, call DELETE /webhooks/indexing/signing-secret.

Example:

"whsec_EXAMPLE_ONLY_THIS_IS_NOT_A_REAL_SIGNING_KEY"

Response

200

application/json

OK

data · object

Show child attributes

Example:

{
  "generated": true,
  "message": "Success",
  "signing_secret": "whsec_EXAMPLE_ONLY_THIS_IS_NOT_A_REAL_SIGNING_KEY"
}

error · object | null

Null on success; an object with code and message on failure.

Show child attributes

Example:

null

meta · object

Show child attributes

Example:

{
  "collection": "team_docs",
  "database": "acme_corp",
  "latency_ms": 12.3,
  "request_id": "9d13aef4-02f4-4e73-8c62-4c2601d04f9d",
  "source_type": "file",
  "sub_tenant_id": "team_docs",
  "tenant_id": "acme_corp"
}

success · boolean

Whether the request succeeded.

Example:

true