Skip to main content
POST
Rotate Webhook Secret

Overview

Generate a new signing secret for a webhook. The old secret becomes invalid immediately. The new secret is only returned once, so make sure to store it securely. This endpoint requires Write scope. Store the returned replacement secret immediately and update signature verification before accepting later deliveries.

Authentication

string
required
Your API key with Write scope

Path Parameters

string
required
Webhook ID (UUID)Example: 770e8400-e29b-41d4-a716-446655440000

Request Examples

Response

boolean
required
Indicates if the request was successful
string
required
Human-readable response message
object
required
Webhook with new secret

Success Response

The secret is a 64-character hex string (32 bytes). This is the raw secret used for HMAC-SHA256 signature verification.

Error Responses

The old secret becomes invalid immediately. After rotating, update your webhook verification code with the new secret before processing any new webhook deliveries.

Rate Limits

  • 100 requests per minute per API key

Next Steps

Webhook Verification

Learn how to verify webhook signatures

Get Webhook

View webhook details