Skip to main content
POST
Rotate the signing secret
Coming soon: The Webhooks API is currently under design review. This documentation describes the target interface and may change before release.

Overview

Generates a new signing secret for the subscription and invalidates the previous one immediately.
Important: rotate the secret if you suspect it has been compromised. Since the previous secret stops working at rotation time, update the secret in your endpoint as soon as you receive the response — deliveries signed with the new secret start immediately.

Authorizations

Authorization
string
header
required

Bearer authentication header of the form Bearer <token>, where <token> is your auth token.

Path Parameters

subscriptionId
string<uuid>
required

The unique identifier of the webhook subscription

Response

Signing secret successfully rotated. The previous secret is invalidated immediately — update your endpoint before rotating.

id
string<uuid>
required

The unique identifier of the subscription.

Example:

"c3d4e5f6-a1b2-4c3d-8e5f-6a7b8c9d0e1f"

signingSecret
string
required

The new secret used to sign webhook payloads (HMAC-SHA256).

Example:

"whsec_9f8e7d6c5b4a3f2e1d0c9b8a7f6e5d4c"