Skip to content
Docs
Async jobs

Get the callback secret

The secret that signs a job callback whose URL is not a registered HTTPS webhook.

GET/v1/async/callback-secret
FreeAsync jobs, destinations, schedules and the callback secret are not changed from the docs; call this with your own key.

A callback URL that matches an enabled HTTPS endpoint from POST /v1/webhooks is signed with that endpoint's secret instead. A disabled endpoint does not match. This account secret is created on first read and can be read again. POST /v1/async/callback-secret/rotate replaces it and keeps the previous secret signing for 24 hours: during that window x-scrapercompany-signature lists both HMACs, comma-separated. The signature is HMAC-SHA256 of x-scrapercompany-timestamp + . + the raw body. Dedupe retries on x-scrapercompany-delivery. Free.

Request

GEThttps://api.scrapercompany.com/v1/async/callback-secret

Authenticate with your API key in the x-api-key header (see Authentication).

Example request

curl "https://api.scrapercompany.com/v1/async/callback-secret" \
  -H "x-api-key: $SCRAPERCOMPANY_API_KEY"

Response

200 — Account callback signing secret. Fields: secret, created_at, rotated_at. Readable again. rotated_at is absent until the first rotation. A callback URL that matches an enabled HTTPS webhook uses that endpoint's secret instead. For 24 hours after rotation the callback signature lists the current and previous HMAC, comma-separated..

200 response
{
  "secret": "whsec_REPLACE_WITH_THE_VALUE_THIS_ENDPOINT_RETURNS",
  "created_at": "2026-10-03T09:12:44Z",
  "rotated_at": "2026-10-03T10:00:00Z"
}

Errors

Errors return a JSON body with a detail field. Failed requests are not charged. See Errors for the full list and retry advice.

StatusMeaningRetry?
401Unauthorized

Missing or invalid API key.

{"detail":"missing or invalid API key"}		No, fix the request
429Too Many Requests

Too many requests: the key's requests-per-minute limit was exceeded, or (in enforce credits mode) the plan's concurrent-request limit. No rate-limit or Retry-After headers are sent; back off and retry.

{"detail":"rate limit 60/min exceeded"}		Yes, with backoff
503Service Unavailable

Temporarily unavailable: a dependency of this endpoint is down, or the upstream source changed its contract. Retry later.

{"detail":"database unavailable: OperationalError"}		Yes, with backoff

Try it

Async jobs, destinations, schedules and the callback secret are not changed from the docs; call this with your own key.

  1. Export your key: export SCRAPERCOMPANY_API_KEY=sk_... (no key yet? start a free trial).
  2. Copy the cURL example above and run it in a terminal.

Questions about this page?

Send the page link and your question, and the team will answer.

Email support