> ## Documentation Index
> Fetch the complete documentation index at: https://docs.ingestly.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Webhook signing key

> Generate and manage your signing key for verifying webhook callback signatures.

Your webhook signing key lets you verify that callback requests are genuinely from Ingestly and have not been tampered with.

## Why use a signing key

Without signature verification, any HTTP request to your callback URL could impersonate Ingestly. A signing key lets you cryptographically verify each request.

## Generating a signing key

1. Go to **Settings** → **Webhook Keys**
2. Click **Generate key**
3. Copy the key and store it securely in your application's configuration

<Warning>Store your signing key securely. Treat it like a password. Never expose it in client-side code or commit it to source control.</Warning>

## Verifying signatures

When Ingestly sends a callback, it includes a signature header computed from the request body using your signing key.

To verify:

1. Read the raw request body
2. Compute an HMAC-SHA256 hash using your signing key
3. Compare the computed hash with the signature in the request header
4. Only process the request if they match

See [webhooks and callbacks](/guides/webhooks-and-callbacks) for code examples in multiple languages.

## Rotating your key

Ingestly supports zero-downtime key rotation. During rotation, both the primary and secondary key are active, and callback signatures are computed with both.

To rotate your signing key:

1. Go to **Settings** → **Webhook Keys**
2. Click **Rotate**. This generates a new primary key and demotes the current key to secondary
3. Copy the new key and update your application to use it
4. Once all integrations are updated, click **Complete rotation** to remove the old secondary key

During rotation, the `X-Ingestly-Signature` header includes signatures from both the old and new key, so your existing integration continues to work while you transition.

<Tip>Plan key rotation during low-traffic periods to minimize the risk of rejected callbacks during the transition.</Tip>

## Revoking your key

To delete your signing key entirely:

1. Go to **Settings** → **Webhook Keys**
2. Click **Revoke**

<Warning>Revoking your signing key means callbacks will no longer include a signature header. Your application should be updated to stop verifying signatures before revoking.</Warning>