# Get the callback secret: `GET /v1/async/callback-secret`

Cost: free (0 (failed requests are free)). Docs: https://scrapercompany.com/docs/reference/async-callback-secret

The secret that signs a job callback whose URL is not a registered
HTTPS webhook.

A callback URL that matches an enabled HTTPS endpoint from `POST
/v1/webhooks` is signed with that endpoint's secret instead. A disabled
endpoint does not match. This account secret is created on first read
and can be read again. `POST /v1/async/callback-secret/rotate` replaces
it and keeps the previous secret signing for 24 hours: during that
window `x-scrapercompany-signature` lists both HMACs, comma-separated.
The signature is HMAC-SHA256 of `x-scrapercompany-timestamp` + `.` + the
raw body. Dedupe retries on `x-scrapercompany-delivery`. Free.

Base URL: `https://api.scrapercompany.com`. Auth: send your key in the `x-api-key` header. A failed request (4xx or 5xx) or an empty result costs 0 credits.

- [Full API reference as one Markdown file](https://scrapercompany.com/llms-full.txt)
- [OpenAPI spec](https://scrapercompany.com/openapi.json)