---
title: 🔐 API Key & Webhook Secret
slug: api-key-and-webhook-secret
docTags: 
createdAt: 2025-06-17T06:34:19.931Z
---

To access MASKIT’s API endpoints and receive webhook callbacks securely, you’ll need two credentials:

- A **public API key** for authenticating your API requests
- A **private webhook shared secret** for verifying the authenticity of webhook calls

Both are generated and delivered together from your dashboard.

***

## 🔑 API Key

All API requests require an API key passed in the request header:

```http
X-Api-Key: YOUR_API_KEY
```

***

### 🔸 How to Obtain Your API Key & Webhook Shared Secret

To obtain your **API key** and **webhook shared secret**:

1. Log in to your MASKIT dashboard.
2. Go to **Account → API Access**.
3. Click **Enable API Access** (or **Regenerate API Key**).

Once generated, you'll see:

- Your **API key** (used in request headers)
- Your **webhook shared secret** (used to validate `X-Signature` HMACs on incoming webhooks)

:::hint{type="warning"}
**Important:** This is the **only time these credentials will be shown.**
Be sure to **copy and store them securely**.
If you lose them, you’ll need to revoke and regenerate a new set.
:::

***

## 📬 Using the Webhook Secret

MASKIT signs every webhook request using `HMAC-SHA256` with your **webhook shared secret**.

You can verify authenticity by recomputing the signature on your server and comparing it with the `X-Signature` header.

See the full guide:
📬 [Webhook Documentation](https://docs.maskit.ai/webhook)

***

## 🧪 Testing

We recommend using Postman or `curl` to test your credentials with the following endpoints:

- `/api/v1/masking/process-image` — to queue a masking job
- `/api/v1/masking/image-status` — to check job progress
- `/api/v1/masking/image-download` — to retrieve the final masked image

Need help? Contact us at [support@maskit.ai](mailto\:support@maskit.ai)