# Channex Webhook Signing Keys API

**Canonical:** https://apis.io/apis/channex/channex-webhook-signing-keys-api/  
**Provider:** Channex — https://apis.io/providers/channex/  
**Base URL:** https://secure.channex.io/api/v1  
**Documentation:** https://docs.channex.io/api-v.1-documentation/hotels-collection

Channex Webhook Signing Keys API is one of 29 APIs that [Channex](https://apis.io/providers/channex/) publishes on the [APIs.io](https://apis.io/) network, described by a machine-readable OpenAPI specification. Tagged areas include Webhook Signing Keys. The published artifact set on APIs.io includes an OpenAPI specification and API documentation.

HMAC keys that sign webhook deliveries, so that a receiving endpoint can tell that a callback came from Channex and that its body was not altered on the way. A key is a shared secret: Channex holds it and so do you. It is not an API credential — it authenticates nothing against this API and grants no access. It is used in one direction only, on the callbacks Channex sends to you. A key belongs to a billing account and holds up to two secret versions — the current one plus an optional pending one, which is what makes rotation zero-downtime. To turn signing on, point a webhook at the key with `signing_key_id` and set `is_signed`. ## What is signed Every delivery of a signed webhook — the `POST` Channex makes to the webhook's `callback_url` — carries three headers: - `x-hmac-timestamp` — Unix timestamp (seconds) taken when the delivery was signed. - `x-hmac-signature-256` — comma-separated lowercase-hex HMAC-SHA256 signatures, one per secret version of the key, the current version first. - `x-hmac-keys-256` — comma-separated version labels (`...` followed by each secret's last 6 characters), in the same order as the signatures. Each signature is computed over the string `{timestamp}.{raw request body}`: the value of `x-hmac-timestamp`, a dot, and the exact bytes of that delivery's body. Nothing else enters it — neither the callback URL nor the webhook's `request_params` and `headers`. ## Verifying a delivery Recompute HMAC-SHA256 over `{timestamp}.{raw body}` with your stored secret, then compare it against the signature at the position whose label in `x-hmac-keys-256` ends with your secret's last 6 characters. ## Rotating a key `generate` adds a pending secret version beside the current one, and deliveries are then signed with both — so verification against the current secret keeps working while the new secret is stored on your side. `rotate` promotes the newest version to be the sole current version, after which deliveries carry its signature alone.

## Operations (8)

| Method | Path | Summary |
|---|---|---|
| GET | `/signing_keys` | List signing keys |
| POST | `/signing_keys` | Create a signing key |
| GET | `/signing_keys/options` | List signing key options |
| GET | `/signing_keys/{id}` | Retrieve a signing key |
| PUT | `/signing_keys/{id}` | Update a signing key |
| DELETE | `/signing_keys/{id}` | Delete a signing key |
| POST | `/signing_keys/{id}/generate` | Generate a secret version |
| POST | `/signing_keys/{id}/rotate` | Rotate a signing key |

## Machine-readable artifacts (10)

- **OpenAPI** — https://raw.githubusercontent.com/api-evangelist/channex/refs/heads/main/openapi/channex-webhook-signing-keys-api-openapi.yml
- **Documentation** — https://docs.channex.io/api-v.1-documentation/hotels-collection
- **PostmanCollection** — https://raw.githubusercontent.com/api-evangelist/channex/refs/heads/main/collections/channex.postman_collection.json
- **OpenCollection** — https://raw.githubusercontent.com/api-evangelist/channex/refs/heads/main/collections/channex.opencollection.json
- **Documentation** — https://docs.channex.io/api-v.1-documentation/room-types-collection
- **Documentation** — https://docs.channex.io/api-v.1-documentation/rate-plans-collection
- **Documentation** — https://docs.channex.io/api-v.1-documentation/ari
- **Documentation** — https://docs.channex.io/api-v.1-documentation/bookings-collection
- **Documentation** — https://docs.channex.io/api-v.1-documentation/channel-api
- **Documentation** — https://docs.channex.io/api-v.1-documentation/webhook-collection

## Other Channex APIs (12)

- [Channex ARI API](https://apis.io/apis/channex/channex-ari-api/)
- [Channex Bookings API](https://apis.io/apis/channex/channex-bookings-api/)
- [Channex Properties API](https://apis.io/apis/channex/channex-properties-api/)
- [Channex Rate Plans API](https://apis.io/apis/channex/channex-rate-plans-api/)
- [Channex Room Types API](https://apis.io/apis/channex/channex-room-types-api/)
- [Channex Webhooks API](https://apis.io/apis/channex/channex-webhooks-api/)
- [Channex Applications API](https://apis.io/apis/channex/channex-applications-api/)
- [Channex Authentication API](https://apis.io/apis/channex/channex-authentication-api/)
- [Channex Authorize.net App API](https://apis.io/apis/channex/channex-authorize-net-app-api/)
- [Channex Booking CRS API](https://apis.io/apis/channex/channex-booking-crs-api/)
- [Channex Booking Messages API](https://apis.io/apis/channex/channex-booking-messages-api/)
- [Channex Booking Payments API](https://apis.io/apis/channex/channex-booking-payments-api/)

## Tags

Webhook Signing Keys

---

Profiled by [API Evangelist](https://apievangelist.com) and published on [APIs.io](https://apis.io/apis/channex/channex-webhook-signing-keys-api/). The API's provider profile, Kin Score and agent-readiness rating are at https://apis.io/providers/channex/.