Skip to main content
People search, enrichment, and outreach. Get started with the clodo API
Webhooks

Signing Secrets

Create and manage the signing secrets used to authenticate webhook deliveries.

Async endpoints (People Search, Deep Search, Phone Enrichment) POST results to a webhook URL you supply per request. Each delivery is signed with HMAC-SHA256 using your webhook signing secret.

An active webhook signing secret is required to call any async endpoint. Calls without one fail with 409 conflict.

#Minting

  1. Open the API Keys tab.
  2. Find the Webhook Signing Secret section.
  3. Click Mint webhook secret.
  4. Copy the raw secret. It is shown once.

The Console displays the secret's prefix and version after creation.

#Rotating

Click Rotate to mint a new secret and invalidate the old one immediately.

#API key vs webhook signing secret

Thing Used for Wire format
API key (ck_live_...) Authenticating your requests to us x-api-key header on outbound requests
Webhook signing secret Verifying webhook deliveries from us to you Clodo-Signature header on inbound webhook POSTs

#Scope

One active webhook signing secret per account. All webhook deliveries to the account use it.

#Headers we send on every webhook

Header Value
User-Agent Clodo-Webhook/1.0
Content-Type application/json
Clodo-Signature t=<unix>,v1=<hmac_sha256_hex> (HMAC over <t>.<body>)
Clodo-Webhook-Event Event type (e.g. search.completed). Lets you route on a header without parsing the body.
Clodo-Webhook-Id Numeric delivery ID. Stable across retry attempts of the same delivery.

#Wire format

The body bytes are canonicalized: keys sorted alphabetically, no whitespace. Sign and verify the bytes you receive on the wire, not a re-serialized JSON dict (key order would diverge and HMAC would fail).

clodo Docs