Signing Secrets
Create and manage the signing secrets used to authenticate webhook deliveries.
Async endpoints (People Search, Deep Search, Phone Enrichment) POST results to a webhook URL you supply per request. Each delivery is signed with HMAC-SHA256 using your webhook signing secret.
An active webhook signing secret is required to call any async endpoint. Calls without one fail with 409 conflict.
#Minting
- Open the API Keys tab.
- Find the Webhook Signing Secret section.
- Click Mint webhook secret.
- Copy the raw secret. It is shown once.
The Console displays the secret's prefix and version after creation.
#Rotating
Click Rotate to mint a new secret and invalidate the old one immediately.
#API key vs webhook signing secret
| Thing | Used for | Wire format |
|---|---|---|
API key (ck_live_...) |
Authenticating your requests to us | x-api-key header on outbound requests |
| Webhook signing secret | Verifying webhook deliveries from us to you | Clodo-Signature header on inbound webhook POSTs |
#Scope
One active webhook signing secret per account. All webhook deliveries to the account use it.
#Headers we send on every webhook
| Header | Value |
|---|---|
User-Agent |
Clodo-Webhook/1.0 |
Content-Type |
application/json |
Clodo-Signature |
t=<unix>,v1=<hmac_sha256_hex> (HMAC over <t>.<body>) |
Clodo-Webhook-Event |
Event type (e.g. search.completed). Lets you route on a header without parsing the body. |
Clodo-Webhook-Id |
Numeric delivery ID. Stable across retry attempts of the same delivery. |
#Wire format
The body bytes are canonicalized: keys sorted alphabetically, no whitespace. Sign and verify the bytes you receive on the wire, not a re-serialized JSON dict (key order would diverge and HMAC would fail).
#What to read next
- Webhook Signature Verification for the HMAC algorithm and verifier code.
- Webhook Events for event types and payload shapes.
- Webhook Retry Policy for retry schedule.