Lost a webhook signing secret? Gemini shows it once, Sume re-reads

If you lose a Sume webhook signing secret, read it again: open the Webhooks tab of the dashboard and use Reveal, or call GET /v1/webhooks/signing-secret with an API key that carries account:read. The Gemini API's static webhooks, by contrast, are described as returning the signing secret only once at creation.

Sume facts are from Webhooks, read 2026-10-01.

Where do I find the Sume signing secret?

Two places: the dashboard page /dashboard/webhooks (Reveal, then copy), or the API endpoint above. The docs say the value is derived for your workspace, so it is yours rather than a shared platform value, and suggest storing it as SUME_COM_WEBHOOK_SIGNING_SECRET.

curl https://api.sume.com/v1/webhooks/signing-secret \
  -H "Authorization: Bearer $SUME_API_KEY"

Is there one secret per webhook?

No. Job webhooks and run webhooks share that one workspace secret, so a single verifier covers both. Sume registers callbacks per job, so there is no per-webhook secret to lose.

How do I know which secret signed a delivery?

Every delivery carries x-sume-webhook-secret-fingerprint, and the receipt repeats it as webhook_delivery.signing_secret_fingerprint. If a signature does not verify, compare that fingerprint with the one shown beside the secret in the dashboard. Neither side has to send the secret itself.

During a rotation the signature header can carry one sume-v1= entry per live secret, newest first. Accept the delivery if any entry matches.

What should I do after reading the secret?

Put it in your secrets manager, not in source control, and make your verifier refuse to run with an empty value. The delivery debugging steps are in this guide.