Skip to main content

Get the public key that verifies our webhook signatures

GET 
/api/partner/webhooks/public-key

Every webhook carries an X-Payload-Signature header: an Ed25519 signature (base64) made with a private key only the platform holds. The signed message is sha256hex(yourSecret) + "." + rawBody, so verifying it with the key returned here proves the webhook came from us, is unaltered, and was made for your secret. The secret itself is never sent. X-Payload-Key-Id tells you which key signed it, so you can pick the right one after a rotation.

Returns 503 if signing is not configured on this environment (webhooks are not sent there either).

Responses​

The platform's webhook verification key