Skip to main content
POST
Rotate a webhook secret
Replaces the webhook’s signing secret. The response includes the new secret; like Create, this is the only time it is returned, so store it securely. Deliveries are signed at send time, so events (including retries already in flight) are signed with the new secret from this point on. Returns the webhook object plus its new secret.
Update your receiver to accept both the old and the new secret before calling this endpoint. The SDK verify helpers accept a list of secrets for exactly this overlap: verify_webhook(body, sig, ts, ["whsec_old", "whsec_new"]). Remove the old secret once deliveries verify against the new one.

Path parameters

webhook_id
string
required
The webhook’s id (UUID).

Examples

Response

Errors