> ## Documentation Index
> Fetch the complete documentation index at: https://docs.apistable.com/llms.txt
> Use this file to discover all available pages before exploring further.

# 回调签名密钥

> 获取本账户专属的 HMAC 验证密钥。

> 能力按服务端配置逐项启用。未启用操作返回 503 且不创建任务；音乐积分扣除当前未启用。

## 保护密钥

认证 API Key 可获得 \{code:200,msg:"success",data:\{secret}}。密钥仅保存在服务端。使用 X-APIstable-Timestamp + "." + 原始正文验证 X-APIstable-Signature（v1=\<HMAC-SHA256 hex>），限制时间窗口，并按 X-APIstable-Event-Id 去重。


## OpenAPI

````yaml openapi.json GET /api/v1/webhooks/secret
openapi: 3.1.0
info:
  title: APIstable API
  version: 1.0.0-preview
  description: >-
    Public /api/v1 protocol. Valid API keys have the same account-scoped access.
    No client submission idempotency or max_credits. Enabled Suno operations use
    PayAPI and durable task processing. Media uses R2: uploads 24 hours,
    generated files 14 days, task logs 30 days. Music credit deduction is
    disabled. Unconfigured operations and LLM return 503.
servers:
  - url: https://apistable.com
    description: APIstable API
security: []
paths:
  /api/v1/webhooks/secret:
    get:
      summary: Read the account-specific webhook verification secret
      operationId: webhookSigningSecret
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                type: object
                required:
                  - code
                  - msg
                  - data
                properties:
                  code:
                    const: 200
                  msg:
                    type: string
                  data:
                    type: object
                    required:
                      - secret
                    properties:
                      secret:
                        type: string
        '401':
          description: '40101: Invalid API key.'
        '503':
          description: Operation or provider unavailable
      security:
        - bearerAuth: []
components:
  securitySchemes:
    bearerAuth:
      type: http
      scheme: bearer
      description: >-
        Every valid key can submit and query its own account. Revoked keys are
        rejected.

````

This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.