Skip to main content
Webhook keys are separate from webhook registrations. A webhook registration defines where Connectly sends events. A webhook key is the HMAC signing secret used to verify that those events actually came from Connectly — it’s included in every request as the x-connectly-hmac-sha256 header.
There is only ever one active webhook key per business at a time. Creating a new key automatically revokes the previous one. Old revoked keys are retained in the system (soft-deleted) but are no longer valid — this is why you may see multiple keys listed when you call the list endpoint.

​
Endpoints

​
List your keys

Use this to see the status of all keys associated with your business — useful if you’re seeing unexpected keys in your account:
The response shows each key’s status (active, expired, or revoked) and created_at timestamp. Only one key will have status: active — the rest are historical rotations.

​
Rotate your key

Creating a new key immediately revokes the current active one:
After rotating, update your webhook handler with the new secret immediately — any requests verified against the old key will fail.

​
Verify webhook payloads

Use the active key to verify the x-connectly-hmac-sha256 header on every incoming webhook request. See Webhooks overview for the verification code example.