> ## Documentation Index
> Fetch the complete documentation index at: https://docs.runflow.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Create callback signing secret

> Generate a new HMAC signing secret for callback delivery. Returns the full secret once.



## OpenAPI

````yaml /api/openapi.public.json post /v1/callback-secrets
openapi: 3.1.0
info:
  title: Runflow API
  version: 0.1.0
  description: >-
    Public Runflow API. Run AI image and video models, manage media, inspect run
    history, and configure webhooks. Auth: HTTP Bearer.


    This document is the customer integration surface only. Admin and internal
    operations plus generic system reference-data tables are intentionally
    omitted.
servers:
  - url: https://api.runflow.io
    description: Production
security:
  - HTTPBearer: []
tags:
  - name: Models
    description: >-
      Browse the model catalog and dispatch model runs. The primary surface for
      running AI image and video generation.
  - name: Runs
    description: >-
      Inspect, cancel, and re-run model executions. Fetch logs, node-runs, and
      callback delivery history.
  - name: Media
    description: >-
      Upload images and videos as inputs. Organize assets into folders.
      Three-step presigned upload flow for large files.
  - name: Batches
    description: >-
      Run a model on multiple inputs in one request. Includes per-item status
      and a single callback when the batch completes.
  - name: Evaluations
    description: >-
      Submit an image generated anywhere for automated quality evaluation, then
      read a pass verdict, a 0-1 score, and structured issues. No Runflow run
      required.
  - name: Webhooks
    description: >-
      Subscribe to platform events. Inspect delivery history, redeliver failed
      callbacks, manage signing secrets.
  - name: Account
    description: Read your account identity and credit balance.
  - name: Status
    description: Health and readiness probes for the API.
paths:
  /v1/callback-secrets:
    post:
      tags:
        - Webhooks
      summary: Create callback signing secret
      description: >-
        Generate a new HMAC signing secret for callback delivery. Returns the
        full secret once.
      operationId: createCallbackSecret
      parameters:
        - name: X-Organization-Id
          in: header
          required: false
          schema:
            anyOf:
              - type: string
              - type: 'null'
            title: X-Organization-Id
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: >-
                #/components/schemas/models__org_callback_secret__OrgCallbackSecret__CreateValidator
      responses:
        '201':
          description: The created secret with the one-time plain secret.
          content:
            application/json:
              schema:
                $ref: >-
                  #/components/schemas/models__org_callback_secret__OrgCallbackSecret__CreatedValidator
        '400':
          description: Bad request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
        '401':
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
        '403':
          description: >-
            Forbidden — inspect response body `code` for the specific reason
            (for example: PERMISSION_DENIED, EMAIL_NOT_VERIFIED,
            ORGANIZATION_MEMBERSHIP_REQUIRED, ROLE_UNRESOLVED,
            IMPERSONATION_READ_ONLY)
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
        '409':
          description: Conflict
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
        '422':
          description: Validation error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
      security:
        - HTTPBearer: []
components:
  schemas:
    models__org_callback_secret__OrgCallbackSecret__CreateValidator:
      properties:
        label:
          anyOf:
            - type: string
              maxLength: 255
            - type: 'null'
          title: Label
      additionalProperties: false
      type: object
      title: CreateValidator
      description: POST body.
    models__org_callback_secret__OrgCallbackSecret__CreatedValidator:
      properties:
        id:
          anyOf:
            - type: string
              format: uuid
            - type: 'null'
          title: Id
        org_id:
          anyOf:
            - type: string
              format: uuid
            - type: 'null'
          title: Org Id
        key_prefix:
          anyOf:
            - type: string
            - type: 'null'
          title: Key Prefix
        is_current:
          anyOf:
            - type: boolean
            - type: 'null'
          title: Is Current
        label:
          anyOf:
            - type: string
            - type: 'null'
          title: Label
        disabled_at:
          anyOf:
            - type: string
              format: date-time
            - type: 'null'
          title: Disabled At
        last_used_at:
          anyOf:
            - type: string
              format: date-time
            - type: 'null'
          title: Last Used At
        created_at:
          anyOf:
            - type: string
              format: date-time
            - type: 'null'
          title: Created At
        updated_at:
          anyOf:
            - type: string
              format: date-time
            - type: 'null'
          title: Updated At
        plain_secret:
          type: string
          title: Plain Secret
      type: object
      required:
        - plain_secret
      title: CreatedValidator
      description: POST response — includes the one-time plain secret.
    ErrorResponse:
      properties:
        code:
          type: string
          title: Code
        message:
          type: string
          title: Message
        errors:
          anyOf:
            - items:
                additionalProperties: true
                type: object
              type: array
            - type: 'null'
          title: Errors
      type: object
      required:
        - code
        - message
      title: ErrorResponse
      description: Standard error envelope — matches exception handler output.
  securitySchemes:
    HTTPBearer:
      type: http
      scheme: bearer

````