Skip to main content
GET
/
v1
/
meta
/
webhook-keys
GET /v1/meta/webhook-keys — active Ed25519 public keys for verifying inbound webhook signatures.
curl --request GET \
  --url https://api.pegana.xyz/v1/meta/webhook-keys
{
  "pubkeys_b64": [
    "<string>"
  ],
  "recheck_after": "2023-11-07T05:31:56Z"
}

Response

200 - application/json

Active webhook-signer public keys

​
pubkeys_b64
string[]
required

Base64-encoded Ed25519 public keys currently signing outbound webhooks. Index 0 is the primary (every new delivery is signed with this); index 1 (when present) is the secondary, active only during a rotation window. Receivers should trust ANY of the listed keys when verifying x-pegana-signature.

​
recheck_after
string<date-time>
required

Hint to refresh weekly — during a rotation this list flips from [A] → [A, B] → [B] over the rotation window. Polling at least once between deploys is enough to follow it.