# The secret webhook signatures are made with

Source: https://docs.usetone.ai/reference/integrations/signingSecret

> Shown so you can configure a verifier.

`GET /v1/integrations/webhooks/signing-secret`
Shown so you can configure a verifier. Compare `x-tone-signature` against an HMAC-SHA256 of `{timestamp}.{raw body}` — the RAW body, before any JSON parsing.

Requires the `admin` scope.

## Response

| Field | Type | | Meaning |
|---|---|---|---|
| `note` | string | required | Which secret this is and what signs with it. Human-readable, not a code. |
| `secret` | string | required | The signing secret, shown once. Verify x-tone-signature against it before trusting any delivery. |

### Example response

```json
{
  "data": {
    "note": "Signs every delivery to this endpoint as x-tone-signature.",
    "secret": "whsec_3f1a7f6e2b4c4d1e9a8b5c6d7e8f9a0b"
  }
}
```