Retrieve Destination Secret

Retrieves the current signing secret for a destination. Use this secret to verify the authenticity of event payloads.

GET /destinations/{destinationId}/secret

This endpoint retrieves the current signing secret for an event destination. You can use this secret to verify the authenticity of event payloads.

1. Call this endpoint with the destination's ID. Stedi returns this ID in the responses from the Create Destination and List Destinations endpoints.
2. The endpoint returns the signing secret for the destination.

If you recently rotated the secret, the response also includes the expiration time for the previous secret, allowing you to support both secrets during the transition period.

Authorizations

Authorization · Required Header

A Stedi API Key for authentication. Supports both test and production API keys.

Path Parameters

destinationId · String Regex pattern : ^[a-z]{3,5}_[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$

The unique identifier for the destination. You can retrieve destination IDs with the List Destinations endpoint.

Response

application/json

previousSecretExpiresAt · String Format : date-time

Expiration timestamp for the previous secret. Only present when a secret rotation is in progress.

signingSecret · String Required Regex pattern : ^whsec_[A-Za-z0-9+/=]+$ Format : password Length : 30 - 255

The signing secret for verifying event payloads. Visit verify event signatures for details.

Request

curl --request GET \
  --url "https://events.us.stedi.com/2026-02-01/destinations/{destinationId}/secret" \
  --header "Authorization: <api_key>"

Response

{
  "signingSecret": "whsec_YWJjZGVmZ2hpamtsbW5vcHFyc3R1dnd4eXoxMjM0NTY="
}