Signing Keys

Signing keys are used to verify the authenticity of webhook payloads sent by Inkbox. Each organization has a single signing key that is used across all webhooks (both mail and phone).

Before you create a signing key, webhooks and WebSocket connections are sent unsigned. Once a key is created, all webhooks and WebSocket upgrades are signed automatically.

The plaintext key is returned only once when created or rotated. Store it securely — it cannot be retrieved again.

POST /signing-keys

Create a new signing key for your organization, or rotate the existing one. On the first call a new key is generated. On subsequent calls the old key is replaced with a fresh one.

Response (201)

JSON

Error responses

Code examples

cURL

cURL

JavaScript

Python

Once you have a signing key, use it to verify incoming webhook payloads. See:

• Mail webhook verification
• Phone webhook verification