🔐 API Key & Webhook Secret

7 min

To access MASKIT’s API endpoints and receive webhook callbacks securely, you’ll need two credentials:

A public API key for authenticating your API requests
A private webhook shared secret for verifying the authenticity of webhook calls

Both are generated and delivered together from your dashboard.

🔑 API Key

All API requests require an API key passed in the request header:

X-Api-Key: YOUR_API_KEY

🔸 How to Obtain Your API Key & Webhook Shared Secret

To obtain your API key and webhook shared secret:

Log in to your MASKIT dashboard.
Go to Account → API Access.
Click Enable API Access (or Regenerate API Key).

Once generated, you'll see:

Your API key (used in request headers)
Your webhook shared secret (used to validate X-Signature HMACs on incoming webhooks)

Important: This is the only time these credentials will be shown. Be sure to copy and store them securely. If you lose them, you’ll need to revoke and regenerate a new set.

📬 Using the Webhook Secret

MASKIT signs every webhook request using HMAC-SHA256 with your webhook shared secret.

You can verify authenticity by recomputing the signature on your server and comparing it with the X-Signature header.

See the full guide: 📬 Webhook Documentation

🧪 Testing

We recommend using Postman or curl to test your credentials with the following endpoints:

/api/v1/masking/process-image — to queue a masking job
/api/v1/masking/image-status — to check job progress
/api/v1/masking/image-download — to retrieve the final masked image

Need help? Contact us at [email protected]