Webhook public keys
Every request goes to https://api.lemak.cash. About the reference.
Webhook public keys
GET /v1/webhook_public_keys
The platform Ed25519 public keys. The v2 half of X-Webhook-Signature verifies against one of these, so a merchant needs no secret to check a delivery. The header names the key it was signed with in v2_kid, which is the id of one entry here: X-Webhook-Signature: t=<unix>,v1=<hex>,v2=<base64>,v1_kid=<n>,v2_kid=<key_id>.
Authentication
Bearer key. The merchant API key, sk_live_ or sk_test_. It reaches /v1 alone. A test key works from the moment the merchant exists. A live key answers 403 live_not_enabled until the merchant's review opens live mode, before any rate limit is spent.
Parameters
| Name | In | Type | Description |
|---|---|---|---|
Api-Version optional | header | string | The version this request is answered at. Absent, the account's pinned version applies, and an account is pinned to info.version on its first request. A version this service does not render is refused with 400 invalid_api_version. api/CHANGELOG.md lists every version. Pattern ^[0-9]{4}-[0-9]{2}-[0-9]{2}$. |
Responses
200
The published keys.
application/json
WebhookPublicKeyList
| Field | Type | Description | |||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
object required | list | ||||||||||||||||
data required | array of WebhookPublicKey | Fields of data
| |||||||||||||||
has_more required | boolean |
Errors
Every error answers with the error object.
| Status | When |
|---|---|
| Other | 400 bad parameter, 401 authentication, 402 payment failed, 403 forbidden, 404 not found, 409 conflict, 413 request_too_large (a body over 64 KiB), 422 idempotency key reused, 429 rate limited, 5xx api error. |
Example
curl https://api.lemak.cash/v1/webhook_public_keys \
-H "Authorization: Bearer sk_test_..." \
-H "Api-Version: 2026-09-01"