Sume webhook secret is per workspace: read it with account:read
Sume derives the webhook signing secret per workspace, not as a shared platform value. Read it on the dashboard or with GET /v1/webhooks/signing-secret.
Sume derives the webhook signing secret for your workspace, so it is yours and not a platform-wide value. You can read it on the Webhooks tab of the dashboard, or from GET /v1/webhooks/signing-secret with an API key that carries account:read. Job webhooks and run webhooks use that one secret, so a single verifier covers both.
Where each place fits
| Where | Needs | Note |
|---|---|---|
| Dashboard Webhooks tab | A signed-in member | Reveal, then copy |
GET /v1/webhooks/signing-secret | API key with account:read | Read it at deploy time instead of pasting it |
| Environment variable | You set it | Use SUME_COM_WEBHOOK_SIGNING_SECRET, the name the delivery worker uses |
Read it from a script
Keep the value out of logs and shell history. The call needs only the scope named above.
curl -s https://api.sume.com/v1/webhooks/signing-secret \
-H "Authorization: Bearer $SUME_API_KEY"When a signature will not verify
Compare x-sume-webhook-secret-fingerprint on the delivery with the fingerprint shown next to the secret in the dashboard. Neither side has to send the secret. A mismatch usually means you hold another workspace's secret, or a secret from before a rotation.
Sources
Related posts
More in Developers
- Sume webhook replay protection: reject timestamps over 5 minutes old
Reject Sume webhook callbacks whose timestamp is outside your tolerance window. The docs suggest five minutes. Redeliveries carry a fresh timestamp.
- Sume webhook_url must be public HTTPS: localhost and http are rejected
Sume rejects localhost, private-network and non-HTTPS webhook URLs. Test local receivers through a public HTTPS tunnel or poll the job instead.
- Sume webhook vs async polling vs sync vs subscribe: pick a mode
Sume has four communication modes: async, sync, webhook and subscribe. Webhook is best for servers, but keep the poll fallback for lost deliveries.
- SvelteKit +server.ts endpoint for an AI video webhook: request.text()
A SvelteKit POST handler reads request.text(), verifies Sume's HMAC over timestamp.body with node:crypto and returns 401 for bad or missing signatures.
Written by Sume