Skip to main content
POST
Rotate a webhook signing secret

Authorizations

Authorization
string
header
required

Project-scoped secret API key (sk_…). Pass in the Authorization: Bearer <key> header. Grants access to the project the key was issued for.

Path Parameters

endpointId
integer | null

Numeric webhook endpoint identifier.

Example:

17

Response

The new plaintext signing secret.

One-time-visible signing secret returned by POST /webhooks/{endpointId}/rotate-secret. Persist it and update any downstream verifier before the next event fires.

signing_secret
string
required

New plaintext signing secret. Returned exactly once — store it now. The previous secret stops verifying deliveries the moment this call returns.

Example:

"whsec_5f6b9c4e2a8d3f1b..."