# Create webhook key

Generate a new inbound webhook signing key.

Source: https://statusdashboard.com/docs/api/integrations/webhooks/inbound/keys/create

`POST /app/integrations/webhooks/inbound/keys`

Creates a new webhook signing key and returns the `signingSecret` **once**. The secret cannot be retrieved again after this response — store it securely immediately and configure it in your external system.

Requires the **integrations** feature entitlement (admin role). Returns `403` when the feature is disabled or your plan allows zero webhook keys. Returns `409` when the organization has reached its webhook key quota.

***

## Request
See [API Basics](/docs/api) for required headers.

### Request body
| Field  | Type   | Required | Description                                                                        |
| ------ | ------ | -------- | ---------------------------------------------------------------------------------- |
| `name` | string | No       | Human-readable label for the key. Defaults to `"Webhook Key"`. Max 100 characters. |

***

## Sample request
```bash
curl -X POST https://api.statusdashboard.com/app/integrations/webhooks/inbound/keys \
  -H "Authorization: Bearer bcf847abf5c6:def456" \
  -H "Content-Type: application/json" \
  -d '{"name": "CRM integration"}'
```

## Sample response
**Status: `201 Created`**

```json
{
  "keyId": "wk_a1b2c3d4e5f6a7b8",
  "signingSecret": "whsec_s3cr3tPlaintext",
  "name": "CRM integration",
  "createdAt": "2026-04-15T12:00:00.000Z"
}
```

The `signingSecret` is returned **only once** and cannot be recovered. Use it to sign payloads sent to the inbound webhook endpoint via the `X-SD-Signature` header. Revoke and recreate the key if lost.

***

## Error responses
| Status | When                                                                                                                                      |
| ------ | ----------------------------------------------------------------------------------------------------------------------------------------- |
| `403`  | Insufficient permissions, the integrations feature is not enabled, or your plan does not allow webhook keys (`webhookKeys` quota is `0`). |
| `409`  | The organization has reached its webhook key quota. Revoke an existing key before creating a new one.                                     |