# Webhook Signing Secrets Async endpoints (People Search, Deep Search, Phone Enrichment) POST results to a webhook URL you supply per request. Each delivery is signed with HMAC-SHA256 using your webhook signing secret. An active webhook signing secret is required to call any async endpoint. Calls without one fail with `409 conflict`. ## Minting 1. Open the **API Keys** tab. 2. Find the **Webhook Signing Secret** section. 3. Click **Mint webhook secret**. 4. Copy the raw secret. It is shown once. The Console displays the secret's prefix and version after creation. ## Rotating Click **Rotate** to mint a new secret and invalidate the old one immediately. ## API key vs webhook signing secret | Thing | Used for | Wire format | |---|---|---| | API key (`ck_live_...`) | Authenticating your requests to us | `x-api-key` header on outbound requests | | Webhook signing secret | Verifying webhook deliveries from us to you | `Clodo-Signature` header on inbound webhook POSTs | ## Scope One active webhook signing secret per account. All webhook deliveries to the account use it. ## Headers we send on every webhook | Header | Value | |---|---| | `User-Agent` | `Clodo-Webhook/1.0` | | `Content-Type` | `application/json` | | `Clodo-Signature` | `t=,v1=` (HMAC over `.`) | | `Clodo-Webhook-Event` | Event type (e.g. `search.completed`). Lets you route on a header without parsing the body. | | `Clodo-Webhook-Id` | Numeric delivery ID. Stable across retry attempts of the same delivery. | ## Wire format The body bytes are canonicalized: keys sorted alphabetically, no whitespace. Sign and verify the bytes you receive on the wire, not a re-serialized JSON dict (key order would diverge and HMAC would fail). ## What to read next - [Webhook Signature Verification](https://docs.clodo.ai/guides/webhook-signing) for the HMAC algorithm and verifier code. - [Webhook Events](https://docs.clodo.ai/guides/webhook-events) for event types and payload shapes. - [Webhook Retry Policy](https://docs.clodo.ai/guides/webhook-retries) for retry schedule.