# Create an identity verification secret

Creates a new identity verification secret for your workspace. Intercom generates a 256-bit, cryptographically random value server-side and returns it once in the response.
**This is the only opportunity to capture the secret.** Store it in your secure configuration immediately. The `secret` field is omitted from all subsequent responses (including `GET /secure_mode_secrets`) — if you lose it, you must rotate a new secret in and delete this one.
You must enable the secret for at least one platform (`supports_android`, `supports_ios`, or `supports_web`). Rotation flow: create the new secret, roll it out to every client signing `user_hash` values, then delete the old secret with `DELETE /secure_mode_secrets/{id}` once traffic has cut over.

Endpoint: POST /secure_mode_secrets
Version: Preview
Security: bearerAuth

## Header parameters:

  - `Intercom-Version` (string)

## Request fields (application/json):

  - `name` (string, required)
    Human-readable name for the secret.
    Example: Production Web

  - `supports_android` (boolean)
    Enable this secret for the Android SDK.
    Example: false

  - `supports_ios` (boolean)
    Enable this secret for the iOS SDK.
    Example: false

  - `supports_web` (boolean)
    Enable this secret for the Messenger on web.
    Example: true

  - `environment_id` (string)
    Limit this secret to one environment, using the `messenger_environment` value from your Messenger installation code. Omit it for a secret that works in every environment.
    Example: k3x9q2m7pa

## Response 201 fields (application/json):

  - `type` (string)
    value is "identity_verification_secret"
    Example: identity_verification_secret

  - `id` (string)
    The id of the secret
    Example: 102

  - `name` (string)
    Human-readable name for the secret, used to identify it in rotation flows
    Example: Production Web

  - `supports_android` (boolean)
    Whether the secret is enabled for the Android SDK
    Example: false

  - `supports_ios` (boolean)
    Whether the secret is enabled for the iOS SDK
    Example: false

  - `supports_web` (boolean)
    Whether the secret is enabled for the Messenger on web
    Example: true

  - `created_at` (integer)
    The time the secret was created, as a Unix timestamp
    Example: 1734537243

  - `environment_id` (string)
    The `messenger_environment` value of the environment the secret is limited to, or `null` if the secret works in every environment
    Example: k3x9q2m7pa

  - `secret` (string)
    The 256-bit HMAC signing key, base64url-encoded. Returned ONCE at creation time and never surfaced again.
    Example: 9Zw0xNs3vKk0fPz9rwKqNbzH3mPVQmQxL9vhSm9Tk4A

## Response 401 fields (application/json):

  - `type` (string, required)
    The type is error.list
    Example: error.list

  - `request_id` (string)
    Example: f93ecfa8-d08a-4325-8694-89aeb89c8f85

  - `errors` (array, required)
    An array of one or more error objects

  - `errors.code` (string, required)
    A string indicating the kind of error, used to further qualify the HTTP response code
    Example: unauthorized

  - `errors.message` (string)
    Optional. Human readable description of the error.
    Example: Access Token Invalid

  - `errors.field` (string)
    Optional. Used to identify a particular field or query parameter that was in error.
    Example: email

## Response 422 fields (application/json):

  - `type` (string, required)
    The type is error.list
    Example: error.list

  - `request_id` (string)
    Example: f93ecfa8-d08a-4325-8694-89aeb89c8f85

  - `errors` (array, required)
    An array of one or more error objects

  - `errors.code` (string, required)
    A string indicating the kind of error, used to further qualify the HTTP response code
    Example: unauthorized

  - `errors.message` (string)
    Optional. Human readable description of the error.
    Example: Access Token Invalid

  - `errors.field` (string)
    Optional. Used to identify a particular field or query parameter that was in error.
    Example: email