> ## Documentation Index
> Fetch the complete documentation index at: https://docs.apistable.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Webhook signing secret

> Retrieve your account-specific HMAC verification secret.

> Operations are enabled individually by server configuration. Disabled operations return 503 without a task. Music credit deduction is currently disabled.

## Protect this secret

Authenticated API keys may retrieve \{code:200,msg:"success",data:\{secret}}. Store the secret server-side. Verify X-APIstable-Signature (v1=\<HMAC-SHA256 hex>) over X-APIstable-Timestamp + "." + the raw request body, enforce a timestamp tolerance, and deduplicate X-APIstable-Event-Id.


## OpenAPI

````yaml openapi.json GET /api/v1/webhooks/secret
openapi: 3.1.0
info:
  title: APIstable API
  version: 1.0.0-preview
  description: >-
    Public /api/v1 protocol. Valid API keys have the same account-scoped access.
    No client submission idempotency or max_credits. Enabled Suno operations use
    PayAPI and durable task processing. Media uses R2: uploads 24 hours,
    generated files 14 days, task logs 30 days. Music credit deduction is
    disabled. Unconfigured operations and LLM return 503.
servers:
  - url: https://apistable.com
    description: APIstable API
security: []
paths:
  /api/v1/webhooks/secret:
    get:
      summary: Read the account-specific webhook verification secret
      operationId: webhookSigningSecret
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                type: object
                required:
                  - code
                  - msg
                  - data
                properties:
                  code:
                    const: 200
                  msg:
                    type: string
                  data:
                    type: object
                    required:
                      - secret
                    properties:
                      secret:
                        type: string
        '401':
          description: '40101: Invalid API key.'
        '503':
          description: Operation or provider unavailable
      security:
        - bearerAuth: []
components:
  securitySchemes:
    bearerAuth:
      type: http
      scheme: bearer
      description: >-
        Every valid key can submit and query its own account. Revoked keys are
        rejected.

````

This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.