# Identity Verification Secrets

Manage HMAC signing secrets for Messenger identity verification — list, create, and rotate out. Signing material is returned only once, at creation time.

 - [GET /secure_mode_secrets](https://developers.intercom.com/docs/references/preview/rest-api/api.intercom.io/identity-verification-secrets/listidentityverificationsecrets.md): Returns the identity verification secrets configured for your workspace. Each entry includes metadata only — the HMAC signing material itself is **never** returned by this endpoint. The raw secret is
 - [POST /secure_mode_secrets](https://developers.intercom.com/docs/references/preview/rest-api/api.intercom.io/identity-verification-secrets/createidentityverificationsecret.md): Creates a new identity verification secret for your workspace. Intercom generates a 256-bit, cryptographically random value server-side and returns it once in the response. **This is the only opportun
 - [DELETE /secure_mode_secrets/{id}](https://developers.intercom.com/docs/references/preview/rest-api/api.intercom.io/identity-verification-secrets/deleteidentityverificationsecret.md): Soft-deletes an identity verification secret. After deletion, any `user_hash` values signed with that secret will no longer verify — Messenger sessions depending on it will be rejected on their next r
 - [Identity Verification Secret](https://developers.intercom.com/docs/references/preview/rest-api/api.intercom.io/identity-verification-secrets/identity_verification_secret.md): Schema: #/components/schemas/identity_verification_secret
 - [Identity Verification Secret (with material)](https://developers.intercom.com/docs/references/preview/rest-api/api.intercom.io/identity-verification-secrets/identity_verification_secret_with_material.md): Schema: #/components/schemas/identity_verification_secret_with_material